Re: Defect in XSH asctime()

["H. Peter Anvin" <yyy@xxxxxxxxx>]

Clive D.W. Feather wrote:
> H. Peter Anvin said:
>
> > > WG14 examined this issue quite a long time ago. We decided that the
> > > behaviour was simply undefined. There is no requirement that a particular
> > > string appear in the buffer, or even that the function call returns in a
> > > sensible state (or at all). It's *UNDEFINED*.
> > I would classify that as a security hazard.
> So is much of the C Standard library when misused. The answer is to do
> validation elsewhere (though there are moves towards a new, secure,
> library).
The problem is that it's highly difficult to validate elsewhere since 
this data might be locale-dependent.

	-hpa