From: Theo Buehler <tb@theobuehler.org>
Subject: Re: date & touch: timegm/mktime checks
To: Theo de Raadt <deraadt@openbsd.org>
Cc: tech@openbsd.org
Date: Sun, 21 Jun 2026 17:43:12 +0200

> > Which means all the tm.tm_wday = -1; in the tree should get that
> > comment.
> 
> Sure, I'm fine with that.

Index: usr.bin/ssh/misc.c
===================================================================
RCS file: /cvs/src/usr.bin/ssh/misc.c,v
diff -u -p -r1.214 misc.c
--- usr.bin/ssh/misc.c	27 May 2026 13:54:15 -0000	1.214
+++ usr.bin/ssh/misc.c	21 Jun 2026 15:40:14 -0000
@@ -2490,11 +2490,11 @@ parse_absolute_time(const char *s, uint6
 	if ((cp = strptime(buf, fmt, &tm)) == NULL || *cp != '\0')
 		return SSH_ERR_INVALID_FORMAT;
 	if (is_utc) {
-		tm.tm_wday = -1;
+		tm.tm_wday = -1;	/* sentinel for error */
 		if ((tt = timegm(&tm)) == -1 && tm.tm_wday == -1)
 			return SSH_ERR_INVALID_FORMAT;
 	} else {
-		tm.tm_wday = -1;
+		tm.tm_wday = -1;	/* sentinel for error */
 		if ((tt = mktime(&tm)) == -1 && tm.tm_wday == -1)
 			return SSH_ERR_INVALID_FORMAT;
 	}
Index: usr.sbin/acme-client/revokeproc.c
===================================================================
RCS file: /cvs/src/usr.sbin/acme-client/revokeproc.c,v
diff -u -p -r1.30 revokeproc.c
--- usr.sbin/acme-client/revokeproc.c	29 May 2026 04:17:55 -0000	1.30
+++ usr.sbin/acme-client/revokeproc.c	21 Jun 2026 15:40:38 -0000
@@ -51,7 +51,7 @@ X509notafter(const X509 *x, time_t *nota
 	if (!ASN1_TIME_to_tm(atim, &t))
 		return -1;
 
-	t.tm_wday = -1;
+	t.tm_wday = -1;		/* sentinel for error */
 	if ((*notafter = timegm(&t)) == -1 && t.tm_wday == -1)
 		return -1;
 
@@ -75,7 +75,7 @@ X509notbefore(const X509 *x, time_t *not
 	if (!ASN1_TIME_to_tm(atim, &t))
 		return -1;
 
-	t.tm_wday = -1;
+	t.tm_wday = -1;		/* sentinel for error */
 	if ((*notbefore = timegm(&t)) == -1 && t.tm_wday == -1)
 		return -1;
 
Index: usr.sbin/ntpd/constraint.c
===================================================================
RCS file: /cvs/src/usr.sbin/ntpd/constraint.c,v
diff -u -p -r1.61 constraint.c
--- usr.sbin/ntpd/constraint.c	1 Jun 2026 12:22:06 -0000	1.61
+++ usr.sbin/ntpd/constraint.c	21 Jun 2026 15:40:14 -0000
@@ -1062,7 +1062,7 @@ httpsdate_request(struct httpsdate *http
 	 */
 	notbefore = tls_peer_cert_notbefore(httpsdate->tls_ctx);
 	notafter = tls_peer_cert_notafter(httpsdate->tls_ctx);
-	httpsdate->tls_tm.tm_wday = -1;
+	httpsdate->tls_tm.tm_wday = -1;		/* sentinel for error */
 	if ((httptime = timegm(&httpsdate->tls_tm)) == -1 &&
 	    httpsdate->tls_tm.tm_wday == -1)
 		goto fail;
@@ -1116,7 +1116,7 @@ httpsdate_query(const char *addr, const 
 	if (httpsdate_request(httpsdate, &when, synced) == -1)
 		return (NULL);
 
-	httpsdate->tls_tm.tm_wday = -1;
+	httpsdate->tls_tm.tm_wday = -1;		/* sentinel for error */
 	t = timegm(&httpsdate->tls_tm);
 	if (t == -1 && httpsdate->tls_tm.tm_wday == -1) {
 		httpsdate_free(httpsdate);
Index: usr.sbin/rpki-client/x509.c
===================================================================
RCS file: /cvs/src/usr.sbin/rpki-client/x509.c,v
diff -u -p -r1.132 x509.c
--- usr.sbin/rpki-client/x509.c	27 May 2026 13:57:16 -0000	1.132
+++ usr.sbin/rpki-client/x509.c	21 Jun 2026 15:40:14 -0000
@@ -298,7 +298,7 @@ x509_get_time(const ASN1_TIME *at, time_
 		return 0;
 	if (!ASN1_TIME_to_tm(at, &tm))
 		return 0;
-	tm.tm_wday = -1;
+	tm.tm_wday = -1;	/* sentinel for error */
 	if ((*t = timegm(&tm)) == -1 && tm.tm_wday == -1)
 		return 0;
 	return 1;