From b3c0019c84781c15b349714f984071a4b5ac5cc5 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Thu, 11 Jun 2026 17:52:01 +0200 Subject: [PATCH] pgp: Fix validity calculation and potential overflow The two fields were swapped in the calculation and the new code also avoids overflowing on 32-bit systems. Fixes: 4cb0e1bb7643 ("Added basic support for PGP certificates (no trust relationships yet)") --- src/libstrongswan/plugins/pgp/pgp_cert.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/src/libstrongswan/plugins/pgp/pgp_cert.c b/src/libstrongswan/plugins/pgp/pgp_cert.c index d07706cc6..5c35eedef 100644 --- a/src/libstrongswan/plugins/pgp/pgp_cert.c +++ b/src/libstrongswan/plugins/pgp/pgp_cert.c @@ -140,6 +140,7 @@ METHOD(certificate_t, get_validity, bool, time_t *not_after) { time_t t, until; + uint64_t expiry = 0; if (when) { @@ -155,18 +156,22 @@ METHOD(certificate_t, get_validity, bool, } if (this->valid) { - until = this->valid + this->created * 24 * 60 * 60; + expiry = this->created + this->valid * 24 * 60 * 60; } - else + if (!expiry || (sizeof(time_t) == 4 && expiry > TIME_32_BIT_SIGNED_MAX)) { /* Jan 19 03:14:07 UTC 2038 */ until = TIME_32_BIT_SIGNED_MAX; } + else + { + until = expiry; + } if (not_after) { *not_after = until; } - return (t >= this->valid && t <= until); + return (t >= this->created && t <= until); } METHOD(certificate_t, get_encoding, bool,