Skip to content

disable default chrono features, fix potential segfault in the time crate#559

Merged
slashrsm merged 1 commit intotag1consulting:mainfrom
jeremyandrews:chronos
Aug 28, 2023
Merged

disable default chrono features, fix potential segfault in the time crate#559
slashrsm merged 1 commit intotag1consulting:mainfrom
jeremyandrews:chronos

Conversation

@jeremyandrews
Copy link
Copy Markdown
Member

@jeremyandrews jeremyandrews commented Aug 25, 2023 •
edited
Loading

A possible workaround for crates affected through the transitive dependency in chrono, is to avoid using the default oldtime feature dependency of the chrono crate by disabling its default-features and manually specifying the required features instead.

This fixes the following issue detailed at the link above:

Unix-like operating systems may segfault due to dereferencing a dangling pointer in specific circumstances. This requires an environment variable to be set in a different thread than the affected functions. This may occur without the user's knowledge, notably in a third-party library.

@jeremyandrews jeremyandrews changed the title disable default chrono features disable default chrono features, fix potential segfault in the time crate Aug 26, 2023
@jeremyandrews
Copy link
Copy Markdown
Member Author

jeremyandrews commented Aug 26, 2023 •
edited
Loading

@LionsAd I don't see the need to declare this a security release, worst-case it seems anther user on the server running the load test could cause the load test to segfault. In general, it would be unwise to run a load test on a shared server anyway. If you agree, we can go ahead and merge as-is.

slashrsm
slashrsm requested changes Aug 28, 2023
View reviewed changes
Comment thread CHANGELOG.md Outdated

## 0.17.2-dev
- [#557](https://github.com/tag1consulting/goose/pull/557) speed up user initialization on Linux
- []() disable unnecessary features in chronos, avoid potential segfault in time crate: https://rustsec.org/advisories/RUSTSEC-2020-0071
Copy link
Copy Markdown
Collaborator

@slashrsm slashrsm Aug 28, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Link missing.

Copy link
Copy Markdown
Member Author

@jeremyandrews jeremyandrews Aug 28, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Oh my! Thank you :)

@slashrsm slashrsm merged commit c4d128f into tag1consulting:main Aug 28, 2023
@jeremyandrews jeremyandrews mentioned this pull request Aug 28, 2023
Merged
@jeremyandrews jeremyandrews deleted the chronos branch September 11, 2023 13:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@slashrsm slashrsm slashrsm approved these changes

Assignees

@fabianx-ai fabianx-ai

@slashrsm slashrsm

@alecsmrekar alecsmrekar

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Potential segfault in the time crate CVE-2020-26235 advisory for time 0.1 dependency

4 participants

@jeremyandrews @slashrsm @fabianx-ai @alecsmrekar