|
 |
590d18 |
From 0ee0de08a6b389a7593198c918dc894c87dcbe96 Mon Sep 17 00:00:00 2001
|
|
|
590d18 |
From: Nathaniel McCallum <npmccallum@redhat.com>
|
|
|
590d18 |
Date: Fri, 25 Sep 2015 11:35:03 -0400
|
|
|
590d18 |
Subject: [PATCH] Fix an integer underflow bug in libotp
|
|
|
590d18 |
|
|
|
590d18 |
Temporarily storing the offset time in an unsigned integer causes the
|
|
|
590d18 |
value of the offset to underflow when a (valid) negative offset value
|
|
|
590d18 |
is generated. Using a signed variable avoids this problem.
|
|
|
590d18 |
|
|
|
590d18 |
https://fedorahosted.org/freeipa/ticket/5333
|
|
|
590d18 |
|
|
|
590d18 |
Reviewed-By: Tomas Babej <tbabej@redhat.com>
|
|
|
590d18 |
---
|
|
|
590d18 |
daemons/ipa-slapi-plugins/libotp/otp_token.c | 6 +++---
|
|
|
590d18 |
1 file changed, 3 insertions(+), 3 deletions(-)
|
|
|
590d18 |
|
|
|
590d18 |
diff --git a/daemons/ipa-slapi-plugins/libotp/otp_token.c b/daemons/ipa-slapi-plugins/libotp/otp_token.c
|
|
|
590d18 |
index 9b90c6a1137b468103d73cd85fd7e0fcafcee616..a3cbfb0621c071f8addb29f7ce02f870a807c61d 100644
|
|
|
590d18 |
--- a/daemons/ipa-slapi-plugins/libotp/otp_token.c
|
|
|
590d18 |
+++ b/daemons/ipa-slapi-plugins/libotp/otp_token.c
|
|
|
590d18 |
@@ -199,10 +199,10 @@ static bool validate(struct otp_token *token, time_t now, ssize_t step,
|
|
|
590d18 |
case TYPE_TOTP:
|
|
|
590d18 |
/* Perform optional synchronization steps. */
|
|
|
590d18 |
if (second != NULL) {
|
|
|
590d18 |
- tmp = (step - now / token->totp.step) * token->totp.step;
|
|
|
590d18 |
- if (!writeattr(token, T("clockOffset"), tmp))
|
|
|
590d18 |
+ long long off = (step - now / token->totp.step) * token->totp.step;
|
|
|
590d18 |
+ if (!writeattr(token, T("clockOffset"), off))
|
|
|
590d18 |
return false;
|
|
|
590d18 |
- token->totp.offset = tmp;
|
|
|
590d18 |
+ token->totp.offset = off;
|
|
|
590d18 |
}
|
|
|
590d18 |
token->totp.watermark = step;
|
|
|
590d18 |
break;
|
|
|
590d18 |
--
|
|
|
590d18 |
2.4.3
|
|
|
590d18 |
|