Page History

Subclause The C Standard, 7.2729.3.1 of the C Standard [ISO/IEC 9899:20112024] provides , provides the following sample implementation of the asctime() function:

...

However, this implementation assumes that the values of the struct tm data in timepiece are within normal ranges and does nothing to enforce the range limit. If any of the values print more characters than expected, the sprintf() function may overflow the result array. For example, if tm_year has the value 12345, then 27 characters (including the terminating null character) are printed, resulting in a buffer overflow.

Standard for Information Technology—Portable Operating System Interface (POSIX®), Base Specifications, Issue 7 The POSIX^® Base Specifications [IEEE Std 1003.1:2013] , says the following about the asctime() and asctime_r() functions:

These functions are included only for compatibility with older implementations. They have undefined behavior if the resulting string would be too long, so the use of these functions should be discouraged. On implementations that do not detect output string length overflow, it is possible to overflow the output buffers in such a way as to cause applications to fail, or possible system security violations. Also, these functions do not support localized date and time formats. To avoid these problems, applications should use strftime() to generate strings from broken-down times.

The C Standard, Annex K also defines asctime_s(), which can be used as a secure substitute for asctime().

The The asctime() function appears in the list of obsolescent functions in MSC24-C. Do not use deprecated or obsolescent functions.

Noncompliant Code Example

Avoid using This noncompliant code example invokes the asctime() function with potentially unsanitized data:

#include <time.h>
 
void func(struct tm *time_tm) {
  char *time = asctime(time_tm);
  /* ... */
}

...

The strftime() function allows you the programmer to specify a more rigorous format and also to specify the maximum size of the resulting time string:

#include <time.h>

enum { maxsize = 26 };
 
void func(struct tm *time) {
  const size_t maxsize = 26;
  char s[maxsize];
  /* Current time representation for locale */
  const char *format = "%c";

  size_t size = strftime(s, maxsize, format, time);
}

This call has the same effects as asctime() but it also ensures that no more than maxsize chars characters are printed, preventing buffer overflow.

Compliant Solution (asctime_s())

The C Standard, Annex K defines the asctime_s() function which serves as a close replacement for the asctime() function but requires an additional argument that specifies the maximum size of the resulting time string:

...

...

#define __STDC_WANT_LIB_EXT1__ 1
#include <time.h>
 
void func(struct tm *time_tm) {
  const size_t maxsize = 26; 
  char buffer[maxsize];
 
  if (asctime_s(buffer, maxsize, &time_tm)) {
    /* Handle error */
  }
}

Risk Assessment

On implementations that do not detect output-string-length overflow, it is possible to overflow the output buffers, resulting in a vulnerability.

Automated Detection

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Related Guidelines

Key here (explains table format and definitions)

Bibliography

...

Image Modified Image Modified Image Modified