_zoneinfo: heap buffer overflow reads from malformed TZif data

Crash report

What happened?

Turns out the first issue was found independently in December 2025 and March 2026 by security researchers, but it isn't considered a security issue. Our OSS Fuzz fuzzer later found a second issue, #492245058.

(See the PR for testcases.)

>>> import _zoneinfo
>>> with open("tzif_invalid_trans_idx", "rb") as f:
...     _zoneinfo.ZoneInfo.from_file(f)
...     
python: ./Modules/_zoneinfo.c:1152: load_data: Assertion `ttinfo_idx < self->num_ttinfos' failed.
Aborted                    (core dumped) /home/stan/dev/cpython/python

>>> import _zoneinfo
>>> with open("tzif_invalid_lookahead", "rb") as f:
...     _zoneinfo.ZoneInfo.from_file(f)
...     
Segmentation fault         (core dumped) /home/stan/dev/cpython/python

I have a patch that fixes both at hand.

CPython versions tested on:

CPython main branch

Operating systems tested on:

No response

Output from running 'python -VV' on the command line:

No response

Linked PRs

Modules/_zoneinfo.c, load_data(), line 1068

import struct
import io
from zoneinfo import ZoneInfo


def build_tzif_v1(timecnt, typecnt, trans_times, trans_types,
                  utcoffs, isdsts, abbr_indices, abbr_str):
    header = b"TZif\x00" + b"\x00" * 15
    header += struct.pack(">6l", 0, 0, 0, timecnt, typecnt, len(abbr_str))

    data = b""
    for t in trans_times:
        data += struct.pack(">l", t)
    for idx in trans_types:
        data += struct.pack("B", idx)
    for i in range(typecnt):
        data += struct.pack(">lbb", utcoffs[i], isdsts[i], abbr_indices[i])
    data += abbr_str

    return header + data


# typecnt=2 -> valid indices: 0, 1
# trans_types=[2] -> index 2 == typecnt
# Buggy check: 2 > 2 = False (passes)
# Correct:     2 >= 2 = True (rejected)
tzif = build_tzif_v1(
    timecnt=1, typecnt=2,
    trans_times=[1000],
    trans_types=[2],
    utcoffs=[0, 3600],
    isdsts=[0, 1],
    abbr_indices=[0, 4],
    abbr_str=b"STD\x00DST\x00",
)

ZoneInfo.from_file(io.BytesIO(tzif))

Output :

python: ../Modules/_zoneinfo.c:1152: load_data: Assertion `ttinfo_idx < self->num_ttinfos' failed.

It is fixed by #145885, no?

Yes fixed, thanks,

gh-145883: Fix two heap-buffer-overflows in `_zoneinfo` (#145885)

pythongh-145883: Fix two heap-buffer-overflows in `_zoneinfo` (python…

[3.14] gh-145883: Fix two heap-buffer-overflows in `_zoneinfo` (GH-14…

[3.13] gh-145883: Fix two heap-buffer-overflows in `_zoneinfo` (GH-14…

pythongh-145883: Fix two heap-buffer-overflows in `_zoneinfo` (python…

Navigation Menu

Repository navigation

`_zoneinfo`: heap buffer overflow reads from malformed TZif data #145883

Crash report

What happened?

CPython versions tested on:

Operating systems tested on:

Output from running 'python -VV' on the command line:

Linked PRs

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

_zoneinfo: heap buffer overflow reads from malformed TZif data #145883

Description

Crash report

What happened?

CPython versions tested on:

Operating systems tested on:

Output from running 'python -VV' on the command line:

Linked PRs

Activity

raminfp commented on Mar 13, 2026

StanFromIreland commented on Mar 13, 2026

raminfp commented on Mar 14, 2026

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions

`_zoneinfo`: heap buffer overflow reads from malformed TZif data #145883