illumos gate

In usr/src/cmd/cron/atq.c, we have the following:

       time_t  jobdate;
        struct tm *unpackeddate;
        char date[18];                          /* reformatted execution date */

        /*
         * Convert the file name to a date.
         */
        jobdate = num(&filename);
        unpackeddate = localtime(&jobdate);

        /* years since 1900 + base century 1900 */
        unpackeddate->tm_year += 1900;
        /*
         * Format the execution date of a job.
         */
        sprintf(date, "%3s %2d, %4d %02d:%02d", mthnames[unpackeddate->tm_mon],
            unpackeddate->tm_mday, unpackeddate->tm_year,
            unpackeddate->tm_hour, unpackeddate->tm_min);

        /*
         * Print the date the job will be executed.
         */
        printf("%-21.18s", date);
}

An astute observer will note that 3 + 1 + 2 + 2 + 4 + 1 + 2 + 1 + 2 = 18, and thus the sprintf() call will write a NUL immediately after the end of date.

Creating any at job and then running atq will trigger the stack smashing protection, but since the user has no way to cause atq to write more than that additional NUL at the end of date, we don't believe this presents a security issue, just a bug.

The fix is fairly trivial -- change the size of date to 19 bytes, though we should also use snprintf() here just since that's almost always (it not always) preferable to sprintf().