68 lines
2.8 KiB
Diff
68 lines
2.8 KiB
Diff
|
From 552603edfed18f30466277d29b70939390fea65b Mon Sep 17 00:00:00 2001
|
||
|
|
From: Pauli <pauli@openssl.org>
|
||
|
|
Date: Tue, 16 Aug 2022 11:05:02 +1000
|
||
|
|
Subject: [PATCH] Coverity 1508534 & 1508540: misuses of time_t
|
||
|
|
|
||
|
|
Avoid problems when the lower 32 bits of time_t roll over by delaying
|
||
|
|
the cast to integer until after the time delta has been computed.
|
||
|
|
|
||
|
|
Reviewed-by: Ben Kaduk <kaduk@mit.edu>
|
||
|
|
Reviewed-by: Matt Caswell <matt@openssl.org>
|
||
|
|
(Merged from https://github.com/openssl/openssl/pull/19004)
|
||
|
|
|
||
|
|
(cherry picked from commit a6cadcbdc3b4f3fbd0fd228e41177f0661b68264)
|
||
|
|
---
|
||
|
|
ssl/statem/extensions_clnt.c | 5 ++---
|
||
|
|
ssl/statem/extensions_srvr.c | 5 ++---
|
||
|
|
2 files changed, 4 insertions(+), 6 deletions(-)
|
||
|
|
|
||
|
|
diff --git a/ssl/statem/extensions_clnt.c b/ssl/statem/extensions_clnt.c
|
||
|
|
index b6f72d685c..1cbaefa9f1 100644
|
||
|
|
--- a/ssl/statem/extensions_clnt.c
|
||
|
|
+++ b/ssl/statem/extensions_clnt.c
|
||
|
|
@@ -1002,7 +1002,7 @@ EXT_RETURN tls_construct_ctos_psk(SSL *s, WPACKET *pkt, unsigned int context,
|
||
|
|
X509 *x, size_t chainidx)
|
||
|
|
{
|
||
|
|
#ifndef OPENSSL_NO_TLS1_3
|
||
|
|
- uint32_t now, agesec, agems = 0;
|
||
|
|
+ uint32_t agesec, agems = 0;
|
||
|
|
size_t reshashsize = 0, pskhashsize = 0, binderoffset, msglen;
|
||
|
|
unsigned char *resbinder = NULL, *pskbinder = NULL, *msgstart = NULL;
|
||
|
|
const EVP_MD *handmd = NULL, *mdres = NULL, *mdpsk = NULL;
|
||
|
|
@@ -1059,8 +1059,7 @@ EXT_RETURN tls_construct_ctos_psk(SSL *s, WPACKET *pkt, unsigned int context,
|
||
|
|
* this in multiple places in the code, so portability shouldn't be an
|
||
|
|
* issue.
|
||
|
|
*/
|
||
|
|
- now = (uint32_t)time(NULL);
|
||
|
|
- agesec = now - (uint32_t)s->session->time;
|
||
|
|
+ agesec = (uint32_t)(time(NULL) - s->session->time);
|
||
|
|
/*
|
||
|
|
* We calculate the age in seconds but the server may work in ms. Due to
|
||
|
|
* rounding errors we could overestimate the age by up to 1s. It is
|
||
|
|
diff --git a/ssl/statem/extensions_srvr.c b/ssl/statem/extensions_srvr.c
|
||
|
|
index 04f64f8106..f110053273 100644
|
||
|
|
--- a/ssl/statem/extensions_srvr.c
|
||
|
|
+++ b/ssl/statem/extensions_srvr.c
|
||
|
|
@@ -1167,7 +1167,7 @@ int tls_parse_ctos_psk(SSL *s, PACKET *pkt, unsigned int context, X509 *x,
|
||
|
|
s->ext.early_data_ok = 1;
|
||
|
|
s->ext.ticket_expected = 1;
|
||
|
|
} else {
|
||
|
|
- uint32_t ticket_age = 0, now, agesec, agems;
|
||
|
|
+ uint32_t ticket_age = 0, agesec, agems;
|
||
|
|
int ret;
|
||
|
|
|
||
|
|
/*
|
||
|
|
@@ -1209,8 +1209,7 @@ int tls_parse_ctos_psk(SSL *s, PACKET *pkt, unsigned int context, X509 *x,
|
||
|
|
}
|
||
|
|
|
||
|
|
ticket_age = (uint32_t)ticket_agel;
|
||
|
|
- now = (uint32_t)time(NULL);
|
||
|
|
- agesec = now - (uint32_t)sess->time;
|
||
|
|
+ agesec = (uint32_t)(time(NULL) - sess->time);
|
||
|
|
agems = agesec * (uint32_t)1000;
|
||
|
|
ticket_age -= sess->ext.tick_age_add;
|
||
|
|
|
||
|
|
--
|
||
|
|
2.17.1
|
||
|
|
|