torproject/tor
1
0
Fork 0
mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2024-12-06 19:41:15 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

Fix an integer overflow bug in the tv_mdiff range check

Browse Source 
The temporary second used for rounding can cause overflow,
depending on the order the compiler performs the operations.
This commit is contained in:
teor (Tim Wilson-Brown)
2016-06-29 12:53:50 +10:00
parent f42dbc4e26
commit 2e51608a8b
1 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/common/util.c
+4 -1
View File
@@ -1394,6 +1394,7 @@ tv_udiff(const struct timeval *start, const struct timeval *end)
long udiff;
long secdiff = end->tv_sec - start->tv_sec;
/* end->tv_usec - start->tv_usec can be up to 1 second */
if (labs(secdiff)+1 > LONG_MAX/1000000) {
log_warn(LD_GENERAL, "comparing times on microsecond detail too far "
"apart: %ld seconds", secdiff);
@@ -1412,7 +1413,9 @@ tv_mdiff(const struct timeval *start, const struct timeval *end)
long mdiff;
long secdiff = end->tv_sec - start->tv_sec;
if (labs(secdiff)+1 > LONG_MAX/1000) {
/* end->tv_usec - start->tv_usec can be up to 1 second,
* but the mdiff calculation adds another temporary second */
if (labs(secdiff)+2 > LONG_MAX/1000) {
log_warn(LD_GENERAL, "comparing times on millisecond detail too far "
"apart: %ld seconds", secdiff);
return LONG_MAX;