s4 auth ntlm: Fix integer overflow in authsam_password_check_and_record

Fix a ubsan detected integer overflow.
../../source4/auth/ntlm/auth_sam.c:445:56: runtime error:
     signed integer overflow: 60 * 600000000
     cannot be represented in type 'int'

In practice this meant that the default for the smb.conf parameter
"old password allowed period" was approximately 16 seconds, rather than
the intended 60 minutes. Similarly the value used would be 22.5 times
less than the value specified in smd.conf.

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Wed Jan 13 23:52:38 UTC 2021 on sn-devel-184

diff --git a/source4/auth/ntlm/auth_sam.c b/source4/auth/ntlm/auth_sam.c
index 70eddc12c53c6b4cd257228b5260bd2ec756f168..c5b271719371b2d72567d0732cf182699684a37d 100644 (file)
--- a/source4/auth/ntlm/auth_sam.c
+++ b/source4/auth/ntlm/auth_sam.c
@@ -442,7 +442,8 @@ static NTSTATUS authsam_password_check_and_record(struct auth4_context *auth_con
                /*
                 * NTTIME uses 100ns units
                 */
-               allowed_period = allowed_period_mins * 60 * 1000*1000*10;
+               allowed_period = (NTTIME) allowed_period_mins *
+                                60 * 1000*1000*10;
                pwdLastSet = samdb_result_nttime(msg, "pwdLastSet", 0);
                tv_now = timeval_current();
                now = timeval_to_nttime(&tv_now);