提交 903f43ce 编写于 作者: J John Ferlan

keepalive: Guard against integer overflow

Don't allow interval to be > MAX_INT/1000 in virKeepAliveStart()

Guard against possible overflow in virKeepAliveTimeout() by setting the
timeout to be MAX_INT/1000 since the math following will multiply it by 1000.
上级 567779e5
......@@ -252,6 +252,12 @@ virKeepAliveStart(virKeepAlivePtr ka,
_("keepalive interval already set"));
goto cleanup;
}
/* Guard against overflow */
if (interval > INT_MAX / 1000) {
virReportError(VIR_ERR_INTERNAL_ERROR,
_("keepalive interval %d too large"), interval);
goto cleanup;
}
ka->interval = interval;
ka->count = count;
ka->countToDeath = count;
......@@ -323,6 +329,9 @@ virKeepAliveTimeout(virKeepAlivePtr ka)
timeout = ka->interval - (time(NULL) - ka->intervalStart);
if (timeout < 0)
timeout = 0;
/* Guard against overflow */
if (timeout > INT_MAX / 1000)
timeout = INT_MAX / 1000;
}
virObjectUnlock(ka);
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册