From 1bb90bdd628536d605357933916227cd314779ab Mon Sep 17 00:00:00 2001
From: nicm <nicm@openbsd.org>
Date: Tue, 29 Sep 2026 11:57:28 +0000
Subject: [PATCH 1/2] Add a maximum repeat size as well as count.

---
 format.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/format.c b/format.c
index 3f6baa0bb..d88e583bf 100644
--- a/format.c
+++ b/format.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: format.c,v 1.421 2026/09/28 16:52:55 nicm Exp $ */
+/* $OpenBSD: format.c,v 1.422 2026/09/29 11:57:28 nicm Exp $ */
 
 /*
  * Copyright (c) 2011 Nicholas Marriott <nicholas.marriott@gmail.com>
@@ -88,9 +88,12 @@ format_job_cmp(struct format_job *fj1, struct format_job *fj2)
 /* Maximum pad and trim width. */
 #define FORMAT_MAX_WIDTH 10000
 
-/* Maximum repeat size. */
+/* Maximum repeat count. */
 #define FORMAT_MAX_REPEAT 10000
 
+/* Maximum repeat result size in bytes. */
+#define FORMAT_MAX_REPEAT_SIZE 65536
+
 /* Maximum precision. */
 #define FORMAT_MAX_PRECISION 100
 
@@ -6409,7 +6412,7 @@ format_replace(struct format_expand_state *es, const char *key, size_t keylen,
 			value = xstrdup("");
 		else {
 			n = strlen(left);
-			if (n != 0 && nrep > (SIZE_MAX - 1) / n) {
+			if (n != 0 && nrep > FORMAT_MAX_REPEAT_SIZE / n) {
 				format_log(es, "repeat is too long: %s", copy);
 				value = xstrdup("");
 			} else {

From c34432980fd6880f2fac276803f62a7364dce35b Mon Sep 17 00:00:00 2001
From: nicm <nicm@openbsd.org>
Date: Tue, 29 Sep 2026 13:59:10 +0000
Subject: [PATCH 2/2] Do not format times that localtime_r and ctime_r cannot
 convert, from Alexandre Fiori.

---
 format.c | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/format.c b/format.c
index d88e583bf..839cb5096 100644
--- a/format.c
+++ b/format.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: format.c,v 1.422 2026/09/29 11:57:28 nicm Exp $ */
+/* $OpenBSD: format.c,v 1.423 2026/09/29 13:59:10 nicm Exp $ */
 
 /*
  * Copyright (c) 2011 Nicholas Marriott <nicholas.marriott@gmail.com>
@@ -4505,8 +4505,8 @@ format_pretty_time(time_t t, int seconds)
 		now = t;
 	age = now - t;
 
-	localtime_r(&now, &now_tm);
-	localtime_r(&t, &tm);
+	if (localtime_r(&now, &now_tm) == NULL || localtime_r(&t, &tm) == NULL)
+		return (xstrdup(""));
 
 	/* Last 24 hours. */
 	if (age < 24 * 3600) {
@@ -4677,10 +4677,12 @@ found:
 			found = format_pretty_time(t, 0);
 		else {
 			if (time_format != NULL) {
-				localtime_r(&t, &tm);
+				if (localtime_r(&t, &tm) == NULL)
+					return (NULL);
 				strftime(s, sizeof s, time_format, &tm);
 			} else {
-				ctime_r(&t, s);
+				if (ctime_r(&t, s) == NULL)
+					return (NULL);
 				s[strcspn(s, "\n")] = '\0';
 			}
 			found = xstrdup(s);