mirrors/haproxy
1
0
Fork 0
mirror of https://git.haproxy.org/git/haproxy.git/ synced 2025-10-27 14:41:28 +01:00
Code Issues Projects Releases Wiki Activity

BUG/MINOR: acme: possible overflow on scheduling computation

Browse Source 
acme_schedule_date() computes the schedule date using notAfter and
notBefore from the certificate. However notBefore could be greater than
notAfter and could result in an overflow.

This is unlikely to happen and would mean an incorrect certificate.

This patch fixes the issue by checking that notAfter > notBefore.

It also replace the int type by a time_t to avoid overflow on 64bits
architecture which is also unlikely to happen with certificates.

Fix issue #3136.

Need to be backported to 3.2.
This commit is contained in:
William Lallemand 2025-09-25 14:39:31 +02:00
parent 3be8b06a60
commit 68770479ea
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/acme.c
View File

@ -2381,7 +2381,7 @@ int acme_will_expire(struct ckch_store *store)
*/
time_t acme_schedule_date(struct ckch_store *store)
{
int diff = 0;
time_t diff = 0;
time_t notAfter = 0;
time_t notBefore = 0;
@ -2395,7 +2395,8 @@ time_t acme_schedule_date(struct ckch_store *store)
notAfter = x509_get_notafter_time_t(store->data->cert);
notBefore = x509_get_notbefore_time_t(store->data->cert);
if (notAfter >= 0 && notBefore >= 0) {
if ((notAfter >= 0 && notBefore >= 0)
&& (notAfter > notBefore)) {
diff = (notAfter - notBefore) / 12; /* validity period / 12 */
} else {
diff = 7 * 24 * 60 * 60; /* default to 7 days */