asn1: clamp far-future times on 32-bit time_t

Compute DER generalized time conversion in uint64_t and clamp to the
local time_t range before returning.  This avoids wrapping far-future
ASN.1 times on 32-bit time_t platforms.  We do not address time_t
being a non-integral type.

lib/asn1/timegm.c

@@ -46,6 +46,21 @@ static const unsigned ndays[2][12] ={
     {31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31},
     {31, 29, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31}};
 
+static time_t
+_clamp_time_t(uint64_t t)
+{
+#if SIZEOF_TIME_T < 8
+#ifdef TIME_T_UNSIGNED
+#define MAX_TIME ((UINT64_C(1) << (SIZEOF_TIME_T * 8)) - 1)
+#else
+#define MAX_TIME ((UINT64_C(1) << ((SIZEOF_TIME_T * 8) - 1)) - 1)
+#endif
+  return t < MAX_TIME ? t : MAX_TIME;
+#else
+  return t;
+#endif
+}
+
 /*
  * This is a simplifed version of timegm(3) that doesn't accept out of
  * bound values that timegm(3) normally accepts but those are not
@@ -55,7 +70,7 @@ static const unsigned ndays[2][12] ={
 time_t
 _der_timegm (struct tm *tm)
 {
-  time_t res = 0;
+  uint64_t res = 0;
   int i;
 
   /*
@@ -89,7 +104,7 @@ _der_timegm (struct tm *tm)
   res += tm->tm_min;
   res *= 60;
   res += tm->tm_sec;
-  return res;
+  return _clamp_time_t(res);
 }
 
 struct tm *

lib/hx509/Makefile.am

@@ -336,6 +336,7 @@ EXTRA_DIST = \
 	data/key2.der \
 	data/nist-data \
 	data/nist-data2 \
+	data/notafter-2338.pem \
 	data/no-proxy-test.crt \
 	data/no-proxy-test.key \
 	data/ocsp-req1.der \

lib/hx509/data/notafter-2338.pem

@@ -0,0 +1,25 @@
+-----BEGIN CERTIFICATE-----
+MIIFATCCAumgAwIBAgIBAjANBgkqhkiG9w0BAQUFADAqMRswGQYDVQQDDBJoeDUwOSBUZXN0IFJv
+b3QgQ0ExCzAJBgNVBAYTAlNFMCAXDTE5MDMyMjIyMjUwMloYDzIzMzgwMTE5MDMxNDA4WjAhMQsw
+CQYDVQQGEwJTRTESMBAGA1UEAwwJVGVzdCBjZXJ0MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIIC
+CgKCAgEA2h1NylGd8Z/XpHpF+HWYZrLFfVPeQjV0gc0en/ND16eDf/uizjxEN4BPITam9slRdJ7i
+m7+t5OtyEWQ2iLOpkWPH7jjE9YwGceUJt+tXXb/bW3IHxSnobzOzoifvH1DwVTNjQSPgsvchd0ur
+nXMqu7ZOiH985cY3PrYgwVc+bVd47w1H6UHn+rYtMj9CBY1Wr/XEuG6ZGucH1aE/KX3OsjmmqwZ6
+4iY52JaeO8iveT6aJE5Lsq/kBw5x3C9wJ5c8ovppm1dLxVNeKAywx1cforImD1+/00V4kFos/Gpn
+M7bBfs0XwFieuoXFFVpaZ9u/LwXNONmUyZV/m2iwYv83ks/Yd77Lcj0PuYBEV8DJEAH9ByUw69hI
+Ba+Y+sRkbVmmao0b1EvzB5ho47tZySH4EbSighsN6IzgpeEcccrDLZBDw+6ZLH1BSDnIAHINgDkj
+oTon7QfKMo80yrudZxN9Me1K2zV6zrOJ42SdPkdO07e9qxIWELtm6Bp3TCrguRZpZhSDTkrzb6uF
+anDGm86Tq3U2o6Wqn0XWon8Xx2/59ec1UaV1xQe+Js57Pyk6dGsXeU7PTAppdVjb66jd8ebMoxhT
+pcWlWqHPN2qxn9PU6w8CQNKuaM68xUbj7viXiO7IpwF6oSOv8zEsKm8Sd9w8UZ1A9Joqe4UpHz7D
+1TeObgkCAwEAAaM5MDcwCQYDVR0TBAIwADALBgNVHQ8EBAMCBeAwHQYDVR0OBBYEFBv07DRCuotn
+rFXyN120aKnYXlh7MA0GCSqGSIb3DQEBBQUAA4ICAQCV9xyZckJP0726P3p1uwE6rc5re7c9XTtG
+UeqaNpRwNhw7/Lqdiw1ENgitpnOCvCPt+VoJj51iEcGUfGFmH4u5Ctw6tesiVN6j5YqUEB+EUm3+
+J8jly6WOqYMWlQ1sPleF4eyCBUdtKK0NhPpAoJb0hKrR4Qu3keJHTwWX+BCg6Fe97UhlVXXa5TTo
+8SCV1kCMQr+02VXIMOjVztgdMGWQOevig+0RA80HwOHEkYSgl45tIuZ1dyF8MotI7dayGS6vJq19
+bM4J4Xi2cmFgIpK430JrNGtfNe/x08Z/kgU80Ah3AWb3V7hl3tPSsb+TsYyjJ+bU4iubzZ2+MYJb
+U91avTkFX4xW8n+bt+/mB5a/itmNu2KYht6qkcP+57unH/D9H2ymBATwwlGhkYya7vmHQjd+nCdy
+WdxgqI7RgZfxFcPYqU6aCemBdjk2swih5V6XN7pDjwYacGk7/nmmXi0mBOm8X1fJ0IDCDUvHDt0E
+5RVJndf/7qMcBFZ94qDTORpZvYWw61TqgYvhF5Sl/uMM0HRC7kr0ZpBJS2S8RzX1smCOdAXQptKU
+tOAPSz816irgJFjBbtBlblj34ZACrkAjJemAmtKn6l38bfhFD9tTkVUyRuNqwFQKWkzoGh6mMz7+
+7batz2o8L7JsR3XxKUMxacMMQlZb2biZe/8rUIc0Lg==
+-----END CERTIFICATE-----

lib/hx509/test_cert.in

@@ -47,6 +47,23 @@ for a in $srcdir/data/*.crt; do
     ${hxtool} print --content FILE:"$a" > /dev/null 2>/dev/null
 done
 
+echo "print certificate with 2338 notAfter"
+${hxtool} print --content FILE:$srcdir/data/notafter-2338.pem > cert-2338.tmp || exit 1
+config=$objdir/../../include/config.h
+if grep '^#define SIZEOF_TIME_T 4$' "$config" > /dev/null; then
+    if grep '^#define TIME_T_UNSIGNED' "$config" > /dev/null; then
+	notafter='notAfter  2106-02-07 06:28:15'
+    else
+	notafter='notAfter  2038-01-19 03:14:07'
+    fi
+else
+    notafter='notAfter  2338-01-19 03:14:08'
+fi
+grep "$notafter" cert-2338.tmp > /dev/null || {
+    cat cert-2338.tmp
+    exit 1
+}
+
 echo "print NULL"
 ${hxtool} print --content NULL: > /dev/null || exit 1