Skip to content

session: clamp uloop timeout to avoid int overflow #30

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Scared-Heart wants to merge 1 commit into
base: master
Choose a base branch
from
Open

session: clamp uloop timeout to avoid int overflow #30

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 26 additions & 2 deletions session.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -248,11 +248,34 @@ rpc_session_dump(struct rpc_session *ses, struct ubus_context *ctx,
ubus_send_reply(ctx, req, buf.head);
}

/*
* Convert a session timeout in seconds to a millisecond value suitable
* for uloop_timeout_set(), clamping to INT_MAX to avoid overflowing the
* int argument. Without this, any timeout exceeding ~2147483 seconds
* (~24.85 days) would wrap around to a negative value and cause libubox
* to fire the timeout callback on the next uloop iteration, destroying
* the session immediately after creation.
*/
static int
rpc_session_timeout_ms(int64_t seconds)
{
int64_t msecs;

if (seconds < 0)
seconds = 0;

msecs = seconds * 1000;
if (msecs > INT_MAX)
msecs = INT_MAX;

return (int)msecs;
}

static void
rpc_touch_session(struct rpc_session *ses)
{
if (ses->timeout > 0)
uloop_timeout_set(&ses->t, ses->timeout * 1000);
uloop_timeout_set(&ses->t, rpc_session_timeout_ms(ses->timeout));
}

static void
Expand Down Expand Up @@ -1315,7 +1338,8 @@ rpc_session_from_blob(struct uci_context *uci, struct blob_attr *attr)

avl_insert(&sessions, &ses->avl);

uloop_timeout_set(&ses->t, blobmsg_get_u64(tb[RPC_DUMP_EXPIRES]) * 1000);
uloop_timeout_set(&ses->t,
rpc_session_timeout_ms(blobmsg_get_u64(tb[RPC_DUMP_EXPIRES])));

return true;
}
Expand Down