log: do not segfault on gmtime errors

Many code paths assume that show_date and show_ident_date
cannot return NULL. For the most part, we handle missing or
corrupt timestamps by showing the epoch time t=0.

However, we might still return NULL if gmtime rejects the
time_t we feed it, resulting in a segfault. Let's catch this
case and just format t=0.

Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>

diff --git a/date.c b/date.c
index 2dae471..f64bbeb 100644 (file)
--- a/date.c
+++ b/date.c
@@ -184,8 +184,10 @@ const char *show_date(unsigned long time, int tz, enum date_mode mode)
                tz = local_tzoffset(time);
 
        tm = time_to_tm(time, tz);
-       if (!tm)
-               return NULL;
+       if (!tm) {
+               tm = time_to_tm(0, 0);
+               tz = 0;
+       }
 
        strbuf_reset(&timebuf);
        if (mode == DATE_SHORT)

diff --git a/t/t4212-log-corrupt.sh b/t/t4212-log-corrupt.sh
index 80542d6..85c6df4 100755 (executable)
--- a/t/t4212-log-corrupt.sh
+++ b/t/t4212-log-corrupt.sh
@@ -76,4 +76,12 @@ test_expect_success 'date parser recognizes time_t overflow' '
        test_cmp expect actual
 '
 
+# date is within 2^63-1, but enough to choke glibc's gmtime
+test_expect_success 'absurdly far-in-future dates produce sentinel' '
+       commit=$(munge_author_date HEAD 999999999999999999) &&
+       echo "Thu Jan 1 00:00:00 1970 +0000" >expect &&
+       git log -1 --format=%ad $commit >actual &&
+       test_cmp expect actual
+'
+
 test_done