[<prev] [next>] [day] [month] [year] [list]
Message-ID: <20260805075720.3520103-1-matthias.goergens@gmail.com>
Date: Wed, 5 Aug 2026 15:57:20 +0800
From: Matthias Goergens <matthias.goergens@...il.com>
To: musl@...ts.openwall.com
Cc: Matthias Goergens <matthias.goergens@...il.com>
Subject: [PATCH] aio: avoid timeout overflow in aio_suspend
aio_suspend converts its relative timeout to an absolute monotonic
deadline with unchecked time_t addition. A sufficiently large valid
interval can overflow the seconds addition or the nanosecond carry.
Validate the relative timespec. Saturate an unrepresentably remote
deadline at the latest time_t value. Preserve the initial completion
scan so an already-completed request ignores its unused timeout.
---
src/aio/aio_suspend.c | 21 +++++++++++++++++----
1 file changed, 17 insertions(+), 4 deletions(-)
diff --git a/src/aio/aio_suspend.c b/src/aio/aio_suspend.c
index 1f0c9aaa..e8095458 100644
--- a/src/aio/aio_suspend.c
+++ b/src/aio/aio_suspend.c
@@ -27,11 +27,24 @@ int aio_suspend(const struct aiocb *const cbs[], int cnt, const struct timespec
}
if (ts) {
+ const time_t max_time = (1ULL<<8*sizeof(time_t)-1)-1;
+ if (ts->tv_sec < 0 || ts->tv_nsec < 0 ||
+ ts->tv_nsec >= 1000000000) {
+ errno = EINVAL;
+ return -1;
+ }
clock_gettime(CLOCK_MONOTONIC, &at);
- at.tv_sec += ts->tv_sec;
- if ((at.tv_nsec += ts->tv_nsec) >= 1000000000) {
- at.tv_nsec -= 1000000000;
- at.tv_sec++;
+ if (ts->tv_sec > max_time-at.tv_sec ||
+ (ts->tv_sec == max_time-at.tv_sec &&
+ ts->tv_nsec >= 1000000000-at.tv_nsec)) {
+ at.tv_sec = max_time;
+ at.tv_nsec = 999999999;
+ } else {
+ at.tv_sec += ts->tv_sec;
+ if ((at.tv_nsec += ts->tv_nsec) >= 1000000000) {
+ at.tv_nsec -= 1000000000;
+ at.tv_sec++;
+ }
}
}
--
2.55.0
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
