Replace localtime() with localtime_r()

Since the result of localtime() is stored in a statically allocated
structure, data was overwritten when a context switch occurred during
(or shortly after) the execution of localtime(), potentially resulting
in critical data corruption. BUG#7 and BUG#8 are likely related.

This patch converts all usages of localtime() with localtime_r(), which
is thread-safe.

Reported-by: Baptiste Jonglez <baptiste@jonglez.org>
Reported-by: Erik Saule <esaule@bmi.osu.edu>
Signed-off-by: Lukas Fleischer <calcurse@cryptocrack.de>

1 files changed, 3 insertions, 3 deletions

diff --git a/src/io.c b/src/io.c
index 9bffe1a..0af8b02 100644
--- a/src/io.c
+++ b/src/io.c
@@ -454,7 +454,7 @@ void io_load_app(void)
 {
   FILE *data_file;
   int c, is_appointment, is_event, is_recursive;
-  struct tm start, end, until, *lt;
+  struct tm start, end, until, lt;
   llist_t exc;
   time_t t;
   int id = 0;
@@ -463,8 +463,8 @@ void io_load_app(void)
   char note[MAX_NOTESIZ + 1], *notep;
 
   t = time(NULL);
-  lt = localtime(&t);
-  start = end = until = *lt;
+  localtime_r(&t, &lt);
+  start = end = until = lt;
 
   data_file = fopen(path_apts, "r");
   EXIT_IF(data_file == NULL, _("failed to open appointment file"));