oysteikt/heimdal
0
0
Fork 0
Code Issues 4 Pull Requests Releases Activity

krb5: avoid time-difference overflow

Browse Source 
Use krb5_time_abs() rather than subtracting time_t values before passing the result to labs().  On signed 32-bit time_t platforms, subtracting far-apart times can overflow before labs() sees the value.
This commit is contained in:
Roland C. Dowdeswell
2026-06-10 13:15:12 +01:00
committed by Nico Williams
parent fdeb3e6e4e
commit f609aae209
4 changed files with 10 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
kdc/kerberos5.c
+2 -2
View File
@@ -952,7 +952,7 @@ pa_enc_ts_validate(astgs_request_t r, const PA_DATA *pa)
r->cname);
goto out;
}
if (labs(kdc_time - p.patimestamp) > r->context->max_skew) {
if (krb5_time_abs(kdc_time, p.patimestamp) > r->context->max_skew) {
char client_time[100];
krb5_format_time(r->context, p.patimestamp,
@@ -962,7 +962,7 @@ pa_enc_ts_validate(astgs_request_t r, const PA_DATA *pa)
_kdc_r_log(r, 4, "Too large time skew, "
"client time %s is out by %u > %u seconds -- %s",
client_time,
(unsigned)labs(kdc_time - p.patimestamp),
(unsigned)krb5_time_abs(kdc_time, p.patimestamp),
r->context->max_skew,
r->cname);
kdc_audit_setkv_number((kdc_request_t)r, KDC_REQUEST_KV_AUTH_EVENT,
kdc/pkinit.c
+2 -2
View File
@@ -432,7 +432,7 @@ pk_check_pkauthenticator_win2k(krb5_context context,
krb5_timeofday (context, &now);
/* XXX cusec */
if (a->ctime == 0 || labs(a->ctime - now) > context->max_skew) {
if (a->ctime == 0 || krb5_time_abs(a->ctime, now) > context->max_skew) {
krb5_clear_error_message(context);
return KRB5KRB_AP_ERR_SKEW;
}
@@ -451,7 +451,7 @@ pk_check_pkauthenticator(krb5_context context,
krb5_timeofday (context, &now);
/* XXX cusec */
if (a->ctime == 0 || labs(a->ctime - now) > context->max_skew) {
if (a->ctime == 0 || krb5_time_abs(a->ctime, now) > context->max_skew) {
krb5_clear_error_message(context);
return KRB5KRB_AP_ERR_SKEW;
}