From a7b9eedcb4c1ab985f28fc923822c24bc6417908 Mon Sep 17 00:00:00 2001
From: florian <florian@openbsd.org>
Date: Thu, 9 May 2024 08:35:40 +0000
Subject: [PATCH] ctime(3) and ctime_r(3) can fail when timestamps are way off.
 Add missing error checks to all calls under sbin/

Input kettenis, millert
OK millert
---
 sbin/dump/itime.c                            | 33 ++++++++++++--
 sbin/dump/main.c                             | 16 ++++---
 sbin/dump/optr.c                             |  9 ++--
 sbin/dump/tape.c                             | 11 +++--
 sbin/dumpfs/dumpfs.c                         | 46 ++++++++++++++-----
 sbin/fsck_ext2fs/inode.c                     |  7 ++-
 sbin/fsck_ext2fs/pass1.c                     | 10 ++--
 sbin/fsck_ffs/inode.c                        |  7 ++-
 sbin/fsdb/fsdbutil.c                         | 24 ++++++----
 sbin/fsirand/fsirand.c                       | 11 +++--
 sbin/mount/mount.c                           |  9 ++--
 sbin/pfctl/pfctl_table.c                     | 36 +++++++++++----
 sbin/restore/tape.c                          | 31 ++++++++++---
 sbin/route/route.c                           |  9 +++-
 sbin/savecore/savecore.c                     | 10 +++-
 sbin/scan_ffs/scan_ffs.c                     | 48 +++++++++++---------
 sbin/sysctl/sysctl.c                         | 18 ++++++--
 sbin/unwind/libunbound/validator/autotrust.c |  6 ++-
 18 files changed, 242 insertions(+), 99 deletions(-)

diff --git a/sbin/dump/itime.c b/sbin/dump/itime.c
index 4498d91b19c..a8713d96c63 100644
--- a/sbin/dump/itime.c
+++ b/sbin/dump/itime.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: itime.c,v 1.26 2023/12/21 08:01:21 otto Exp $	*/
+/*	$OpenBSD: itime.c,v 1.27 2024/05/09 08:35:40 florian Exp $	*/
 /*	$NetBSD: itime.c,v 1.4 1997/04/15 01:09:50 lukem Exp $	*/
 
 /*-
@@ -162,7 +162,7 @@ putdumptime(void)
 	FILE *df;
 	struct dumpdates *dtwalk;
 	int fd, i;
-	char *fname;
+	char *fname, *ct;
 	time_t t;
 
 	if(uflag == 0)
@@ -213,12 +213,21 @@ putdumptime(void)
 		quit("ftruncate (%s): %s\n", dumpdates, strerror(errno));
 	(void) fclose(df);
 	t = (time_t)spcl.c_date;
-	msg("level %c dump on %s", level, t == 0 ? "the epoch\n" : ctime(&t));
+	if (t == 0)
+		ct = "the epoch\n";
+	else if ((ct = ctime(&t)) == NULL)
+		ct = "?\n";
+	msg("level %c dump on %s", level, ct);
 }
 
 static void
 dumprecout(FILE *file, struct dumpdates *what)
 {
+	char *ct;
+
+	ct = ctime(&what->dd_ddate);
+	if (ct == NULL)
+		quit("Cannot convert date\n");
 
 	if (fprintf(file, DUMPOUTFMT,
 		    what->dd_name,
@@ -243,8 +252,22 @@ getrecord(FILE *df, struct dumpdates *ddatep)
 			dumpdates, recno);
 
 #ifdef FDEBUG
-	msg("getrecord: %s %c %s", ddatep->dd_name, ddatep->dd_level,
-	    ddatep->dd_ddate == 0 ? "the epoch\n" : ctime(&ddatep->dd_ddate));
+	{
+		char *ct;
+
+		if (ddatep->dd_ddate == 0)
+			ct = "the epoch\n";
+		else
+			ct = ctime(&ddatep->dd_ddate);
+
+		if (ct)
+			msg("getrecord: %s %c %s", ddatep->dd_name,
+			    ddatep->dd_level, ct);
+		else
+			msg("getrecord: %s %c %lld seconds after the epoch\n",
+			    ddatep->dd_name, ddatep->dd_level,
+			    ddatep->dd_ddate);
+	}
 #endif
 	return(0);
 }
diff --git a/sbin/dump/main.c b/sbin/dump/main.c
index a5071abedd3..0e613397f29 100644
--- a/sbin/dump/main.c
+++ b/sbin/dump/main.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: main.c,v 1.65 2024/01/09 03:16:00 guenther Exp $	*/
+/*	$OpenBSD: main.c,v 1.66 2024/05/09 08:35:40 florian Exp $	*/
 /*	$NetBSD: main.c,v 1.14 1997/06/05 11:13:24 lukem Exp $	*/
 
 /*-
@@ -117,7 +117,7 @@ main(int argc, char *argv[])
 	ino_t maxino;
 	time_t t;
 	int dirlist;
-	char *toplevel, *str, *mount_point = NULL, *realpath;
+	char *toplevel, *str, *mount_point = NULL, *realpath, *ct;
 	int just_estimate = 0;
 	u_int64_t zero_uid = 0;
 
@@ -423,11 +423,13 @@ main(int argc, char *argv[])
 	        getdumptime();		/* /etc/dumpdates snarfed */
 
 	t = (time_t)spcl.c_date;
+	ct = ctime(&t);
 	msg("Date of this level %c dump: %s", level,
-		t == 0 ? "the epoch\n" : ctime(&t));
+	    t == 0 ? "the epoch\n" : ct ? ct : "?\n");
 	t = (time_t)spcl.c_ddate;
+	ct = ctime(&t);
  	msg("Date of last level %c dump: %s", lastlevel,
-		t == 0 ? "the epoch\n" : ctime(&t));
+	    t == 0 ? "the epoch\n" : ct ? ct : "?\n");
 	msg("Dumping %s ", disk);
 	if (mount_point != NULL)
 		msgtail("(%s) ", mount_point);
@@ -589,10 +591,12 @@ main(int argc, char *argv[])
 		    spcl.c_tapea, spcl.c_volume,
 		    (spcl.c_volume == 1) ? "" : "s");
 	t = (time_t)spcl.c_date;
+	ct = ctime(&t);
 	msg("Date of this level %c dump: %s", level,
-	    t == 0 ? "the epoch\n" : ctime(&t));
+	    t == 0 ? "the epoch\n" : ct ? ct : "?\n");
 	t = do_stats();
-	msg("Date this dump completed:  %s", ctime(&t));
+	ct = ctime(&t);
+	msg("Date this dump completed:  %s", ct ? ct : "?\n");
 	msg("Average transfer rate: %ld KB/s\n", xferrate / tapeno);
 	putdumptime();
 	trewind();
diff --git a/sbin/dump/optr.c b/sbin/dump/optr.c
index 43f11d58457..2a8f34ec58b 100644
--- a/sbin/dump/optr.c
+++ b/sbin/dump/optr.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: optr.c,v 1.41 2023/03/08 04:43:06 guenther Exp $	*/
+/*	$OpenBSD: optr.c,v 1.42 2024/05/09 08:35:40 florian Exp $	*/
 /*	$NetBSD: optr.c,v 1.11 1997/05/27 08:34:36 mrg Exp $	*/
 
 /*-
@@ -394,8 +394,11 @@ lastdump(int arg)
 		if (strncmp(lastname, dtwalk->dd_name,
 		    sizeof(dtwalk->dd_name)) == 0)
 			continue;
-		date = (char *)ctime(&dtwalk->dd_ddate);
-		date[16] = '\0';	/* blast away seconds and year */
+		date = ctime(&dtwalk->dd_ddate);
+		if (date)
+			date[16] = '\0'; /* blast away seconds and year */
+		else
+			date = "?";
 		lastname = dtwalk->dd_name;
 		dt = fstabsearch(dtwalk->dd_name);
 		dumpme = (dt != NULL &&
diff --git a/sbin/dump/tape.c b/sbin/dump/tape.c
index 835fd223835..ad964c763b8 100644
--- a/sbin/dump/tape.c
+++ b/sbin/dump/tape.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: tape.c,v 1.48 2023/03/08 04:43:06 guenther Exp $	*/
+/*	$OpenBSD: tape.c,v 1.49 2024/05/09 08:35:40 florian Exp $	*/
 /*	$NetBSD: tape.c,v 1.11 1997/06/05 11:13:26 lukem Exp $	*/
 
 /*-
@@ -231,11 +231,13 @@ do_stats(void)
 {
 	time_t tnow, ttaken;
 	int64_t blocks;
+	char *ct;
 
 	(void)time(&tnow);
 	ttaken = tnow - tstart_volume;
 	blocks = spcl.c_tapea - tapea_volume;
-	msg("Volume %d completed at: %s", tapeno, ctime(&tnow));
+	ct = ctime(&tnow);
+	msg("Volume %d completed at: %s", tapeno, ct ? ct : "?\n");
 	if (ttaken > 0) {
 		msg("Volume %d took %lld:%02lld:%02lld\n", tapeno,
 		    (long long)ttaken / 3600, ((long long)ttaken % 3600) / 60,
@@ -565,7 +567,7 @@ startnewtape(int top)
 	pid_t	childpid;
 	int	status;
 	pid_t	waitingpid;
-	char	*p;
+	char	*p, *ct;
 	sig_t	interrupt_save;
 
 	interrupt_save = signal(SIGINT, SIG_IGN);
@@ -688,7 +690,8 @@ restore_check_point:
 		writeheader((ino_t)slp->inode);
 		if (sblock->fs_magic != FS_UFS2_MAGIC)
 			spcl.c_flags &=~ DR_NEWHEADER;
-		msg("Volume %d started at: %s", tapeno, ctime(&tstart_volume));
+		ct = ctime(&tstart_volume);
+		msg("Volume %d started at: %s", tapeno, ct ? ct : "?\n");
 		if (tapeno > 1)
 			msg("Volume %d begins with blocks from inode %llu\n",
 			    tapeno, (unsigned long long)slp->inode);
diff --git a/sbin/dumpfs/dumpfs.c b/sbin/dumpfs/dumpfs.c
index 481f5b41e95..c4e2fda8a0f 100644
--- a/sbin/dumpfs/dumpfs.c
+++ b/sbin/dumpfs/dumpfs.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: dumpfs.c,v 1.38 2024/02/03 18:51:57 beck Exp $	*/
+/*	$OpenBSD: dumpfs.c,v 1.39 2024/05/09 08:35:40 florian Exp $	*/
 
 /*
  * Copyright (c) 2002 Networks Associates Technology, Inc.
@@ -163,13 +163,19 @@ dumpfs(int fd, const char *name)
 	off_t off;
 	int i, j;
 	u_int cg;
+	char *ct;
 
 	switch (afs.fs_magic) {
 	case FS_UFS2_MAGIC:
 		fssize = afs.fs_size;
 		fstime = afs.fs_time;
-		printf("magic\t%x (FFS2)\ttime\t%s",
-		    afs.fs_magic, ctime(&fstime));
+		ct = ctime(&fstime);
+		if (ct)
+			printf("magic\t%x (FFS2)\ttime\t%s",
+			    afs.fs_magic, ctime(&fstime));
+		else
+			printf("magic\t%x (FFS2)\ttime\t%lld\n",
+			    afs.fs_magic, fstime);
 		printf("superblock location\t%jd\tid\t[ %x %x ]\n",
 		    (intmax_t)afs.fs_sblockloc, afs.fs_id[0], afs.fs_id[1]);
 		printf("ncg\t%u\tsize\t%jd\tblocks\t%jd\n",
@@ -178,8 +184,13 @@ dumpfs(int fd, const char *name)
 	case FS_UFS1_MAGIC:
 		fssize = afs.fs_ffs1_size;
 		fstime = afs.fs_ffs1_time;
-		printf("magic\t%x (FFS1)\ttime\t%s",
-		    afs.fs_magic, ctime(&fstime));
+		ct = ctime(&fstime);
+		if (ct)
+			printf("magic\t%x (FFS1)\ttime\t%s",
+			    afs.fs_magic, ctime(&fstime));
+		else
+			printf("magic\t%x (FFS1)\ttime\t%lld\n",
+			    afs.fs_magic, fstime);
 		printf("id\t[ %x %x ]\n", afs.fs_id[0], afs.fs_id[1]);
 		i = 0;
 		if (afs.fs_postblformat != FS_42POSTBLFMT) {
@@ -325,6 +336,7 @@ dumpcg(const char *name, int fd, u_int c)
 	time_t cgtime;
 	off_t cur;
 	int i, j;
+	char *ct;
 
 	printf("\ncg %u:\n", c);
 	cur = (off_t)fsbtodb(&afs, cgtod(&afs, c)) * DEV_BSIZE;
@@ -335,18 +347,30 @@ dumpcg(const char *name, int fd, u_int c)
 	switch (afs.fs_magic) {
 	case FS_UFS2_MAGIC:
 		cgtime = acg.cg_ffs2_time;
-		printf("magic\t%x\ttell\t%jx\ttime\t%s",
-		    acg.cg_magic, (intmax_t)cur, ctime(&cgtime));
+		ct = ctime(&cgtime);
+		if (ct)
+			printf("magic\t%x\ttell\t%jx\ttime\t%s",
+			    acg.cg_magic, (intmax_t)cur, ct);
+		else
+			printf("magic\t%x\ttell\t%jx\ttime\t%lld\n",
+			    acg.cg_magic, (intmax_t)cur, cgtime);
 		printf("cgx\t%u\tndblk\t%u\tniblk\t%u\tinitiblk %u\n",
 		    acg.cg_cgx, acg.cg_ndblk, acg.cg_ffs2_niblk,
 		    acg.cg_initediblk);
 		break;
 	case FS_UFS1_MAGIC:
 		cgtime = acg.cg_time;
-		printf("magic\t%x\ttell\t%jx\ttime\t%s",
-		    afs.fs_postblformat == FS_42POSTBLFMT ?
-		    ((struct ocg *)&acg)->cg_magic : acg.cg_magic,
-		    (intmax_t)cur, ctime(&cgtime));
+		ct = ctime(&cgtime);
+		if (ct)
+			printf("magic\t%x\ttell\t%jx\ttime\t%s",
+			    afs.fs_postblformat == FS_42POSTBLFMT ?
+			    ((struct ocg *)&acg)->cg_magic : acg.cg_magic,
+			    (intmax_t)cur, ct);
+		else
+			printf("magic\t%x\ttell\t%jx\ttime\t%lld\n",
+			    afs.fs_postblformat == FS_42POSTBLFMT ?
+			    ((struct ocg *)&acg)->cg_magic : acg.cg_magic,
+			    (intmax_t)cur, cgtime);
 		printf("cgx\t%u\tncyl\t%d\tniblk\t%d\tndblk\t%u\n",
 		    acg.cg_cgx, acg.cg_ncyl, acg.cg_niblk, acg.cg_ndblk);
 		break;
diff --git a/sbin/fsck_ext2fs/inode.c b/sbin/fsck_ext2fs/inode.c
index a1861b08623..d8aeb5d7bc8 100644
--- a/sbin/fsck_ext2fs/inode.c
+++ b/sbin/fsck_ext2fs/inode.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: inode.c,v 1.30 2024/04/23 13:34:50 jsg Exp $	*/
+/*	$OpenBSD: inode.c,v 1.31 2024/05/09 08:35:40 florian Exp $	*/
 /*	$NetBSD: inode.c,v 1.8 2000/01/28 16:01:46 bouyer Exp $	*/
 
 /*
@@ -581,7 +581,10 @@ pinode(ino_t ino)
 	printf("SIZE=%llu ", (long long)inosize(dp));
 	t = (time_t) letoh32(dp->e2di_mtime);
 	p = ctime(&t);
-	printf("MTIME=%12.12s %4.4s ", &p[4], &p[20]);
+	if (p)
+		printf("MTIME=%12.12s %4.4s ", &p[4], &p[20]);
+	else
+		printf("MTIME=%lld ", t);
 }
 
 void
diff --git a/sbin/fsck_ext2fs/pass1.c b/sbin/fsck_ext2fs/pass1.c
index 377852c1c80..ae31836e7fb 100644
--- a/sbin/fsck_ext2fs/pass1.c
+++ b/sbin/fsck_ext2fs/pass1.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: pass1.c,v 1.18 2019/07/01 07:13:44 kevlo Exp $	*/
+/*	$OpenBSD: pass1.c,v 1.19 2024/05/09 08:35:40 florian Exp $	*/
 /*	$NetBSD: pass1.c,v 1.9 2000/01/31 11:40:12 bouyer Exp $	*/
 
 /*
@@ -167,8 +167,12 @@ checkinode(ino_t inumber, struct inodesc *idesc)
 	if (dp->e2di_dtime != 0) {
 		time_t t = letoh32(dp->e2di_dtime);
 		char *p = ctime(&t);
-		pwarn("INODE I=%llu HAS DTIME=%12.12s %4.4s",
-		    (unsigned long long)inumber, &p[4], &p[20]);
+		if (p)
+			pwarn("INODE I=%llu HAS DTIME=%12.12s %4.4s",
+			    (unsigned long long)inumber, &p[4], &p[20]);
+		else
+			pwarn("INODE I=%llu HAS DTIME=%lld",
+			    (unsigned long long)inumber, t);
 		if (preen) {
 			printf(" (CORRECTED)\n");
 		}
diff --git a/sbin/fsck_ffs/inode.c b/sbin/fsck_ffs/inode.c
index ebda1d4a10d..9a2679e3cdf 100644
--- a/sbin/fsck_ffs/inode.c
+++ b/sbin/fsck_ffs/inode.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: inode.c,v 1.51 2024/01/09 03:16:00 guenther Exp $	*/
+/*	$OpenBSD: inode.c,v 1.52 2024/05/09 08:35:40 florian Exp $	*/
 /*	$NetBSD: inode.c,v 1.23 1996/10/11 20:15:47 thorpej Exp $	*/
 
 /*
@@ -544,7 +544,10 @@ pinode(ino_t ino)
 	printf("SIZE=%llu ", (unsigned long long)DIP(dp, di_size));
 	t = DIP(dp, di_mtime);
 	p = ctime(&t);
-	printf("MTIME=%12.12s %4.4s ", &p[4], &p[20]);
+	if (p)
+		printf("MTIME=%12.12s %4.4s ", &p[4], &p[20]);
+	else
+		printf("MTIME=%lld ", t);
 }
 
 void
diff --git a/sbin/fsdb/fsdbutil.c b/sbin/fsdb/fsdbutil.c
index cb6e842a747..362211a25d5 100644
--- a/sbin/fsdb/fsdbutil.c
+++ b/sbin/fsdb/fsdbutil.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: fsdbutil.c,v 1.20 2019/02/05 02:17:32 deraadt Exp $	*/
+/*	$OpenBSD: fsdbutil.c,v 1.21 2024/05/09 08:35:40 florian Exp $	*/
 /*	$NetBSD: fsdbutil.c,v 1.5 1996/09/28 19:30:37 christos Exp $	*/
 
 /*-
@@ -127,17 +127,25 @@ printstat(const char *cp, ino_t inum, union dinode *dp)
 	    DIP(dp, di_mode), DIP(dp, di_size));
 	t = DIP(dp, di_mtime);
 	p = ctime(&t);
-	printf("\n\tMTIME=%15.15s %4.4s [%d nsec]", &p[4], &p[20],
-	    DIP(dp, di_mtimensec));
+	if (p)
+		printf("\n\tMTIME=%15.15s %4.4s [%d nsec]", &p[4], &p[20],
+		    DIP(dp, di_mtimensec));
+	else
+		printf("\n\tMTIME=%lld [%d nsec]", t, DIP(dp, di_mtimensec));
 	t = DIP(dp, di_ctime);
 	p = ctime(&t);
-	printf("\n\tCTIME=%15.15s %4.4s [%d nsec]", &p[4], &p[20],
-	    DIP(dp, di_ctimensec));
+	if (p)
+		printf("\n\tCTIME=%15.15s %4.4s [%d nsec]", &p[4], &p[20],
+		    DIP(dp, di_ctimensec));
+	else
+		printf("\n\tCTIME=%lld [%d nsec]", t, DIP(dp, di_ctimensec));
 	t = DIP(dp, di_atime);
 	p = ctime(&t);
-	printf("\n\tATIME=%15.15s %4.4s [%d nsec]\n", &p[4], &p[20],
-	    DIP(dp, di_atimensec));
-
+	if (p)
+		printf("\n\tATIME=%15.15s %4.4s [%d nsec]\n", &p[4], &p[20],
+		    DIP(dp, di_atimensec));
+	else
+		printf("\n\tATIME=%lld [%d nsec]\n", t, DIP(dp, di_atimensec));
 	if ((name = user_from_uid(DIP(dp, di_uid), 1)) != NULL)
 		printf("OWNER=%s ", name);
 	else
diff --git a/sbin/fsirand/fsirand.c b/sbin/fsirand/fsirand.c
index 8aef979ae94..2ccc85ce79e 100644
--- a/sbin/fsirand/fsirand.c
+++ b/sbin/fsirand/fsirand.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: fsirand.c,v 1.43 2020/06/20 07:49:04 otto Exp $	*/
+/*	$OpenBSD: fsirand.c,v 1.44 2024/05/09 08:35:40 florian Exp $	*/
 
 /*
  * Copyright (c) 1997 Todd C. Miller <millert@openbsd.org>
@@ -226,8 +226,13 @@ fsirand(char *device)
 	if (printonly && (sblock->fs_id[0] || sblock->fs_id[1])) {
 		if (sblock->fs_inodefmt >= FS_44INODEFMT && sblock->fs_id[0]) {
 			time_t t = sblock->fs_id[0];	/* XXX 2038 */
-			(void)printf("%s was randomized on %s", devpath,
-			    ctime(&t));
+			char *ct = ctime(&t);
+			if (ct)
+				(void)printf("%s was randomized on %s", devpath,
+				    ct);
+			else
+				(void)printf("%s was randomized on %lld\n",
+				    devpath, t);
 		}
 		(void)printf("fsid: %x %x\n", sblock->fs_id[0],
 		    sblock->fs_id[1]);
diff --git a/sbin/mount/mount.c b/sbin/mount/mount.c
index eaff190b572..a30d670db1e 100644
--- a/sbin/mount/mount.c
+++ b/sbin/mount/mount.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: mount.c,v 1.77 2023/07/23 23:21:19 kn Exp $	*/
+/*	$OpenBSD: mount.c,v 1.78 2024/05/09 08:35:40 florian Exp $	*/
 /*	$NetBSD: mount.c,v 1.24 1995/11/18 03:34:29 cgd Exp $	*/
 
 /*
@@ -503,9 +503,10 @@ prmount(struct statfs *sf)
 		char buf[26];
 		time_t t = sf->f_ctime;
 
-		ctime_r(&t, buf);
-		buf[24] = '\0';
-		printf(", ctime=%s", buf);
+		if (ctime_r(&t, buf))
+			printf(", ctime=%.24s", buf);
+		else
+			printf(", ctime=%lld", t);
 	}
 
 	/*
diff --git a/sbin/pfctl/pfctl_table.c b/sbin/pfctl/pfctl_table.c
index ba21402943d..6443126900e 100644
--- a/sbin/pfctl/pfctl_table.c
+++ b/sbin/pfctl/pfctl_table.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: pfctl_table.c,v 1.87 2024/01/15 07:23:32 sashan Exp $ */
+/*	$OpenBSD: pfctl_table.c,v 1.88 2024/05/09 08:35:40 florian Exp $ */
 
 /*
  * Copyright (c) 2002 Cedric Berger
@@ -389,14 +389,19 @@ print_table(struct pfr_table *ta, int verbose, int debug)
 void
 print_tstats(struct pfr_tstats *ts, int debug)
 {
-	time_t	time = ts->pfrts_tzero;
-	int	dir, op;
+	time_t	 time = ts->pfrts_tzero;
+	int	 dir, op;
+	char	*ct;
 
 	if (!debug && !(ts->pfrts_flags & PFR_TFLAG_ACTIVE))
 		return;
+	ct = ctime(&time);
 	print_table(&ts->pfrts_t, 1, debug);
 	printf("\tAddresses:   %d\n", ts->pfrts_cnt);
-	printf("\tCleared:     %s", ctime(&time));
+	if (ct)
+		printf("\tCleared:     %s", ct);
+	else
+		printf("\tCleared:     %lld\n", time);
 	printf("\tReferences:  [ Anchors: %-18d Rules: %-18d ]\n",
 	    ts->pfrts_refcnt[PFR_REFCNT_ANCHOR],
 	    ts->pfrts_refcnt[PFR_REFCNT_RULE]);
@@ -487,11 +492,16 @@ print_addrx(struct pfr_addr *ad, struct pfr_addr *rad, int dns)
 void
 print_astats(struct pfr_astats *as, int dns)
 {
-	time_t	time = as->pfras_tzero;
-	int	dir, op;
+	time_t	 time = as->pfras_tzero;
+	int	 dir, op;
+	char	*ct;
 
+	ct = ctime(&time);
 	print_addrx(&as->pfras_a, NULL, dns);
-	printf("\tCleared:     %s", ctime(&time));
+	if (ct)
+		printf("\tCleared:     %s", ctime(&time));
+	else
+		printf("\tCleared:     %lld\n", time);
 	if (as->pfras_a.pfra_states)
 		printf("\tActive States:      %d\n", as->pfras_a.pfra_states);
 	if (as->pfras_a.pfra_type == PFRKE_COST)
@@ -603,8 +613,9 @@ pfctl_show_ifaces(const char *filter, int opts)
 void
 print_iface(struct pfi_kif *p, int opts)
 {
-	time_t	tzero = p->pfik_tzero;
-	int	i, af, dir, act;
+	time_t	 tzero = p->pfik_tzero;
+	int	 i, af, dir, act;
+	char	*ct;
 
 	printf("%s", p->pfik_name);
 	if (opts & PF_OPT_VERBOSE) {
@@ -615,7 +626,12 @@ print_iface(struct pfi_kif *p, int opts)
 
 	if (!(opts & PF_OPT_VERBOSE2))
 		return;
-	printf("\tCleared:     %s", ctime(&tzero));
+
+	ct = ctime(&tzero);
+	if (ct)
+		printf("\tCleared:     %s", ct);
+	else
+		printf("\tCleared:     %lld\n", tzero);
 	printf("\tReferences:  [ States:  %-18d Rules: %-18d ]\n",
 	    p->pfik_states, p->pfik_rules);
 	for (i = 0; i < 8; i++) {
diff --git a/sbin/restore/tape.c b/sbin/restore/tape.c
index 4288c79e1a6..fc7f2802345 100644
--- a/sbin/restore/tape.c
+++ b/sbin/restore/tape.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: tape.c,v 1.53 2023/03/08 04:43:07 guenther Exp $	*/
+/*	$OpenBSD: tape.c,v 1.54 2024/05/09 08:35:40 florian Exp $	*/
 /*	$NetBSD: tape.c,v 1.26 1997/04/15 07:12:25 lukem Exp $	*/
 
 /*
@@ -387,8 +387,18 @@ gethdr:
 	}
 	if (tmpbuf.c_date != dumpdate || tmpbuf.c_ddate != dumptime) {
 		time_t t = (time_t)tmpbuf.c_date;
-		fprintf(stderr, "Wrong dump date\n\tgot: %s", ctime(&t));
-		fprintf(stderr, "\twanted: %s", ctime(&dumpdate));
+		char ct1buf[26], ct2buf[26];
+		char *ct1, *ct2;
+
+		ct1 = ctime_r(&t, ct1buf);
+		ct2 = ctime_r(&dumpdate, ct2buf);
+		if (ct1 && ct2) {
+			fprintf(stderr, "Wrong dump date\n\tgot: %s", ct1);
+			fprintf(stderr, "\twanted: %s", ct2);
+		} else {
+			fprintf(stderr, "Wrong dump date\n\tgot: %lld\n", t);
+			fprintf(stderr, "\twanted: %lld\n", dumpdate);
+		}
 		volno = 0;
 		goto again;
 	}
@@ -488,12 +498,21 @@ void
 printdumpinfo(void)
 {
 	time_t t;
+	char *ct;
 
 	t = (time_t)spcl.c_date;
-	fprintf(stdout, "Dump   date: %s", ctime(&t));
+	ct = ctime(&t);
+	if (ct)
+		fprintf(stdout, "Dump   date: %s", ct);
+	else
+		fprintf(stdout, "Dump   date: %lld\n", t);
 	t = (time_t)spcl.c_ddate;
-	fprintf(stdout, "Dumped from: %s",
-	    (spcl.c_ddate == 0) ? "the epoch\n" : ctime(&t));
+	ct = ctime(&t);
+	if (ct)
+		fprintf(stdout, "Dumped from: %s",
+		    (spcl.c_ddate == 0) ? "the epoch\n" : ct);
+	else
+		fprintf(stdout, "Dumped from: %lld\n", t);
 	if (spcl.c_host[0] == '\0')
 		return;
 	fprintf(stderr, "Level %d dump of %s on %s:%s\n",
diff --git a/sbin/route/route.c b/sbin/route/route.c
index 4228114edc7..490d29ace6a 100644
--- a/sbin/route/route.c
+++ b/sbin/route/route.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: route.c,v 1.266 2024/04/28 16:43:42 florian Exp $	*/
+/*	$OpenBSD: route.c,v 1.267 2024/05/09 08:35:40 florian Exp $	*/
 /*	$NetBSD: route.c,v 1.16 1996/04/15 18:27:05 cgd Exp $	*/
 
 /*
@@ -1140,6 +1140,7 @@ monitor(int argc, char *argv[])
 	int n;
 	char msg[2048];
 	time_t now;
+	char *ct;
 
 	verbose = 1;
 	for (;;) {
@@ -1149,7 +1150,11 @@ monitor(int argc, char *argv[])
 			err(1, "read");
 		}
 		now = time(NULL);
-		printf("got message of size %d on %s", n, ctime(&now));
+		ct = ctime(&now);
+		if (ct)
+			printf("got message of size %d on %s", n, ct);
+		else
+			printf("got message of size %d on %lld\n", n, now);
 		print_rtmsg((struct rt_msghdr *)msg, n);
 	}
 }
diff --git a/sbin/savecore/savecore.c b/sbin/savecore/savecore.c
index afc223e5a08..dc8b2cb6601 100644
--- a/sbin/savecore/savecore.c
+++ b/sbin/savecore/savecore.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: savecore.c,v 1.65 2022/12/04 23:50:47 cheloha Exp $	*/
+/*	$OpenBSD: savecore.c,v 1.66 2024/05/09 08:35:40 florian Exp $	*/
 /*	$NetBSD: savecore.c,v 1.26 1996/03/18 21:16:05 leo Exp $	*/
 
 /*-
@@ -608,6 +608,7 @@ int
 get_crashtime(void)
 {
 	time_t dumptime;			/* Time the dump was taken. */
+	char *ct;
 
 	(void)KREAD(kd_dump, dump_nl[X_TIME].n_value, &dumptime);
 	if (dumptime == 0) {
@@ -615,7 +616,12 @@ get_crashtime(void)
 			syslog(LOG_ERR, "dump time is zero");
 		return (0);
 	}
-	(void)printf("savecore: system went down at %s", ctime(&dumptime));
+	ct = ctime(&dumptime);
+	if (ct)
+		printf("savecore: system went down at %s", ct);
+	else
+		printf("savecore: system went down %lld seconds after the"
+		    " epoch\n", dumptime);
 #define	SECSPERDAY	(24 * 60 * 60)
 #define	LEEWAY		(7 * SECSPERDAY)
 	if (dumptime < now - LEEWAY || dumptime > now + LEEWAY) {
diff --git a/sbin/scan_ffs/scan_ffs.c b/sbin/scan_ffs/scan_ffs.c
index d1b673c4dca..2a731bec52f 100644
--- a/sbin/scan_ffs/scan_ffs.c
+++ b/sbin/scan_ffs/scan_ffs.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: scan_ffs.c,v 1.23 2019/06/28 13:32:46 deraadt Exp $	*/
+/*	$OpenBSD: scan_ffs.c,v 1.24 2024/05/09 08:35:40 florian Exp $	*/
 
 /*
  * Copyright (c) 1998 Niklas Hallqvist, Tobias Weingartner
@@ -47,6 +47,28 @@
 
 static void usage(void);
 
+static void
+print_info(int flags, struct fs *sb, long long at, char* lastmount)
+{
+	if (flags & FLAG_LABELS ) {
+		printf("X: %lld %lld 4.2BSD %d %d %d # %s\n",
+		    ((off_t)sb->fs_ffs1_size * sb->fs_fsize / 512), at,
+		    sb->fs_fsize, sb->fs_bsize, sb->fs_cpg, lastmount);
+	} else {
+		/* XXX 2038 */
+		time_t t = sb->fs_ffs1_time;
+		char *ct = ctime(&t);
+		if (ct)
+			printf("ffs at %lld size %lld mount %s time %s", at,
+			    (long long)(off_t) sb->fs_ffs1_size * sb->fs_fsize,
+			    lastmount, ct);
+		else
+			printf("ffs at %lld size %lld mount %s time %lld\n", at,
+			    (long long)(off_t) sb->fs_ffs1_size * sb->fs_fsize,
+			    lastmount, t);
+	}
+}
+
 static int
 ufsscan(int fd, daddr_t beg, daddr_t end, int flags)
 {
@@ -76,27 +98,9 @@ ufsscan(int fd, daddr_t beg, daddr_t end, int flags)
 					    sb->fs_ffs1_size);
 
 				if (((blk+(n/512)) - lastblk) == (SBSIZE/512)) {
-					if (flags & FLAG_LABELS ) {
-						printf("X: %lld %lld 4.2BSD %d %d %d # %s\n",
-						    ((off_t)sb->fs_ffs1_size *
-						    sb->fs_fsize / 512),
-						    (long long)(blk + (n/512) -
-						    (2*SBSIZE/512)),
-						    sb->fs_fsize, sb->fs_bsize,
-						    sb->fs_cpg, lastmount);
-					} else {
-						/* XXX 2038 */
-						time_t t = sb->fs_ffs1_time;
-
-						printf("ffs at %lld size %lld "
-						    "mount %s time %s",
-						    (long long)(blk+(n/512) -
-						    (2*SBSIZE/512)),
-						    (long long)(off_t)sb->fs_ffs1_size *
-						    sb->fs_fsize,
-						    lastmount, ctime(&t));
-					}
-
+					print_info(flags, sb,
+					    (long long)(blk + (n/512) -
+					    (2*SBSIZE/512)),  lastmount);
 					if (flags & FLAG_SMART) {
 						off_t size = (off_t)sb->fs_ffs1_size *
 						    sb->fs_fsize;
diff --git a/sbin/sysctl/sysctl.c b/sbin/sysctl/sysctl.c
index 9beb8167536..fe087843300 100644
--- a/sbin/sysctl/sysctl.c
+++ b/sbin/sysctl/sysctl.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: sysctl.c,v 1.260 2024/02/11 21:29:12 bluhm Exp $	*/
+/*	$OpenBSD: sysctl.c,v 1.261 2024/05/09 08:35:40 florian Exp $	*/
 /*	$NetBSD: sysctl.c,v 1.9 1995/09/30 07:12:50 thorpej Exp $	*/
 
 /*
@@ -937,8 +937,14 @@ parse(char *string, int flags)
 		struct timeval *btp = (struct timeval *)buf;
 
 		if (!nflag) {
+			char *ct;
 			boottime = btp->tv_sec;
-			(void)printf("%s%s%s", string, equ, ctime(&boottime));
+			ct = ctime(&boottime);
+			if (ct)
+				(void)printf("%s%s%s", string, equ, ct);
+			else
+				(void)printf("%s%s%lld\n", string, equ,
+				    boottime);
 		} else
 			(void)printf("%lld\n", (long long)btp->tv_sec);
 		return;
@@ -2855,9 +2861,11 @@ print_sensor(struct sensor *s)
 		time_t t = s->tv.tv_sec;
 		char ct[26];
 
-		ctime_r(&t, ct);
-		ct[19] = '\0';
-		printf(", %s.%03ld", ct, s->tv.tv_usec / 1000);
+		if (ctime_r(&t, ct)) {
+			ct[19] = '\0';
+			printf(", %s.%03ld", ct, s->tv.tv_usec / 1000);
+		} else
+			printf(", %lld.%03ld", t, s->tv.tv_usec / 1000);
 	}
 }
 
diff --git a/sbin/unwind/libunbound/validator/autotrust.c b/sbin/unwind/libunbound/validator/autotrust.c
index 3eb13b35c22..2c386644d7a 100644
--- a/sbin/unwind/libunbound/validator/autotrust.c
+++ b/sbin/unwind/libunbound/validator/autotrust.c
@@ -1084,7 +1084,11 @@ trustanchor_state2str(autr_state_type s)
 /** ctime r for autotrust */
 static char* autr_ctime_r(time_t* t, char* s)
 {
-	ctime_r(t, s);
+	if (ctime_r(t, s) == NULL) {
+		s[0] = '?';
+		s[1] = '\n';
+		s[2] = '\0';
+	}
 #ifdef USE_WINSOCK
 	if(strlen(s) > 10 && s[7]==' ' && s[8]=='0')
 		s[8]=' '; /* fix error in windows ctime */
-- 
2.20.1