Fix potential buffer underflow when stripping trailing newlines

app/src/locale.cc

@@ -33,10 +33,9 @@
 #define UCHAR_TYPE wchar_t
 #include <icu.h>
 #elif FIREBASE_PLATFORM_LINUX
-#include <stdio.h>
-
 #include <clocale>
 #include <ctime>
+#include <fstream>
 #else
 #error "Unknown platform."
 #endif  // platform selector
@@ -225,17 +224,13 @@ std::string GetTimezone() {
 
 #elif FIREBASE_PLATFORM_LINUX
   // Ubuntu: Check /etc/timezone for the full time zone name.
-  FILE* tz_file = fopen("/etc/timezone", "r");
-  if (tz_file) {
-    const size_t kBufSize = 128;
-    char buf[kBufSize];
-    if (fgets(buf, kBufSize, tz_file)) {
-      // Remove a trailing '\n', if any.
-      size_t len = strlen(buf);
-      if (buf[len - 1] == '\n') {
-        buf[len - 1] = '\0';
-      }
-      return std::string(buf);
+  std::ifstream tz_file("/etc/timezone");
+  std::string tz;
+  if (std::getline(tz_file, tz)) {
+    // Trim trailing whitespace, including the '\r' of a CRLF line ending.
+    tz.erase(tz.find_last_not_of(" \t\r\n") + 1);
+    if (!tz.empty()) {
+      return tz;
     }
   }
   // If TZ environment variable is defined and not empty, use it, else use

release_build_files/readme.md

@@ -615,6 +615,8 @@ code.
 ## Release Notes
 ### Upcoming
 - Changes
+    - General (Linux Desktop): Fixed a potential 1-byte buffer underflow and file
+      descriptor leak when reading `/etc/timezone` in `GetTimezone()`.
     - Database, Functions, Storage (Android): Fixed a crash in `GetInstance()`
       when initialization fails. It now returns `nullptr` and reports
       `kInitResultFailedMissingDependency`.

testing/run_all_tests.cc

@@ -21,6 +21,9 @@
 #include <jni.h>
 #include <stdio.h>
 
+#include <fstream>
+#include <string>
+
 #include "base/logging.h"
 #include "gtest/gtest.h"
 
@@ -90,13 +93,11 @@ extern "C" JNIEXPORT jint JNICALL JNI_FUNCTION_NAME
 #ifdef OUTPUT_TO_INFO
   if (fp != nullptr) {
     LOG(INFO) << "Native test logs:";
-    fseek(fp, 0, SEEK_SET);
-    char log[256];
-    while (!feof(fp)) {
-      if (fgets(log, 256, fp)) {
-        log[strlen(log) - 1] = '\0';  // Remove newline.
-        LOG(INFO) << log;
-      }
+    fflush(fp);
+    std::ifstream log_file(log_path);
+    std::string line;
+    while (std::getline(log_file, line)) {
+      LOG(INFO) << line;
     }
     fclose(fp);
   } else {