diff mbox series

[Openvpn-devel,v1] tls_crypt: Fix Coverity complaint in tls_crypt_v2_check_client_key_age

Message ID 20251122162553.12254-1-gert@greenie.muc.de
State New
Headers
Series [Openvpn-devel,v1] tls_crypt: Fix Coverity complaint in tls_crypt_v2_check_client_key_age |

Commit Message

Gert Doering Nov. 22, 2025, 4:25 p.m. UTC 
  From: Frank Lichtenheld <frank@lichtenheld.com>

Coverity complained about "overflow_before_widen" because
there is a theoretical overflow that can happen even though
the target value is wide enough. For useful values of max_days
this is irrelevant but Coverity is not wrong, so change the
code accordingly.

Change-Id: Ie7308d549182a95b86cd113e4a8cc65ff45ba3d7
Signed-off-by: Frank Lichtenheld <frank@lichtenheld.com>
Acked-by: Gert Doering <gert@greenie.muc.de>
Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1385
---

This change was reviewed on Gerrit and approved by at least one
developer. I request to merge it to master.

Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1385
This mail reflects revision 1 of this Change.

Acked-by according to Gerrit (reflected above):
Gert Doering <gert@greenie.muc.de>

Comments

Gert Doering Nov. 22, 2025, 5:38 p.m. UTC | #1 
What it says... :-) - stared-at, not tested in any meaningful way.

Your patch has been applied to the master branch.

commit 2969837ad347a227e1d33b1c71390d85f16aa2cd
Author: Frank Lichtenheld
Date:   Sat Nov 22 17:25:47 2025 +0100

     tls_crypt: Fix Coverity complaint in tls_crypt_v2_check_client_key_age

     Signed-off-by: Frank Lichtenheld <frank@lichtenheld.com>
     Acked-by: Gert Doering <gert@greenie.muc.de>
     Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1385
     Message-Id: <20251122162553.12254-1-gert@greenie.muc.de>
     URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg34585.html
     Signed-off-by: Gert Doering <gert@greenie.muc.de>


--
kind regards,

Gert Doering
diff mbox series

Patch

diff --git a/src/openvpn/tls_crypt.c b/src/openvpn/tls_crypt.c
index 318c939..9026cff 100644
--- a/src/openvpn/tls_crypt.c
+++ b/src/openvpn/tls_crypt.c
@@ -539,7 +539,7 @@ 
     int64_t timestamp;
     memcpy(&timestamp, metadata + 1, sizeof(int64_t));
     timestamp = (int64_t)ntohll((uint64_t)timestamp);
-    int64_t max_age_in_seconds = max_days * 24 * 60 * 60;
+    int64_t max_age_in_seconds = (int64_t)max_days * 24 * 60 * 60;
     if (now - timestamp > max_age_in_seconds)
     {
         msg(M_WARN, "ERROR: Client key is too old.");