oysteikt/heimdal
0
0
Fork 0
Code Issues 4 Pull Requests Releases Activity

krb5: avoid time-difference overflow

Browse Source 
Use krb5_time_abs() rather than subtracting time_t values before passing the result to labs().  On signed 32-bit time_t platforms, subtracting far-apart times can overflow before labs() sees the value.
This commit is contained in:
Roland C. Dowdeswell
2026-06-10 13:15:12 +01:00
committed by Nico Williams
parent fdeb3e6e4e
commit f609aae209
4 changed files with 10 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
kuser/kinit.c
+4 -2
View File
@@ -1104,7 +1104,8 @@ get_new_tickets(krb5_context context,
}
if (ticket_life != 0) {
if (labs(cred.times.endtime - cred.times.starttime - ticket_life) > 30) {
if (krb5_time_abs(cred.times.endtime - cred.times.starttime,
ticket_life) > 30) {
char life[64];
unparse_time_approx(cred.times.endtime - cred.times.starttime,
life, sizeof(life));
@@ -1112,7 +1113,8 @@ get_new_tickets(krb5_context context,
}
}
if (renew_life) {
if (labs(cred.times.renew_till - cred.times.starttime - renew) > 30) {
if (krb5_time_abs(cred.times.renew_till - cred.times.starttime,
renew) > 30) {
char life[64];
unparse_time_approx(cred.times.renew_till - cred.times.starttime,
life, sizeof(life));