shadow-maint/shadow

Y2038: overflow in strtoday with 32-bit long and 64-bit time_t

dtaylor84 opened this issue · 3 comments

I think there's a missing pair of parentheses in strtoday():

https://github.com/shadow-maint/shadow/blob/master/libmisc/strtoday.c#L76

return (long) (t + DAY / 2) / DAY;

should be

return (long) ((t + DAY / 2) / DAY);

to avoid the intermediate calculations overflowing with a 32-bit long.

(Noted here https://rachelbythebay.com/w/2023/01/26/shadow/)

Regarding Y2038: today I became aware of https://github.com/thkukuk/lastlog2

not sure why we need the explicit cast at all. seems easier to delete it.

That would be simpler, yes.