denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

pgp: Fix validity calculation and potential overflow

Browse Source 
The two fields were swapped in the calculation and the new code also
avoids overflowing on 32-bit systems.

Fixes: 4cb0e1bb76 ("Added basic support for PGP certificates (no trust relationships yet)")
This commit is contained in:
Tobias Brunner
2026-07-21 10:37:43 +02:00
parent 3582906332
commit b3c0019c84
1 changed files with 8 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libstrongswan/plugins/pgp/pgp_cert.c
+8 -3
View File
@@ -140,6 +140,7 @@ METHOD(certificate_t, get_validity, bool,
time_t *not_after) time_t *not_after)
{ {
time_t t, until; time_t t, until;
uint64_t expiry = 0;
if (when) if (when)
{ {
@@ -155,18 +156,22 @@ METHOD(certificate_t, get_validity, bool,
} }
if (this->valid) if (this->valid)
{ {
until = this->valid + this->created * 24 * 60 * 60; expiry = this->created + this->valid * 24 * 60 * 60;
} }
else if (!expiry || (sizeof(time_t) == 4 && expiry > TIME_32_BIT_SIGNED_MAX))
{ {
/* Jan 19 03:14:07 UTC 2038 */ /* Jan 19 03:14:07 UTC 2038 */
until = TIME_32_BIT_SIGNED_MAX; until = TIME_32_BIT_SIGNED_MAX;
} }
else
{
until = expiry;
}
if (not_after) if (not_after)
{ {
*not_after = until; *not_after = until;
} }
return (t >= this->valid && t <= until); return (t >= this->created && t <= until);
} }
METHOD(certificate_t, get_encoding, bool, METHOD(certificate_t, get_encoding, bool,