Addressed review comment from @wcawijngaards

diff --git a/util/data/packed_rrset.c b/util/data/packed_rrset.c
index 6147233ab686274de90134bd95ee0bdc80e66948..e1a0833a209837b5071e0c616e9026edd9b0c99a 100644 (file)
--- a/util/data/packed_rrset.c
+++ b/util/data/packed_rrset.c
@@ -276,6 +276,7 @@ int packed_rr_to_string(struct ub_packed_rrset_key* rrset, size_t i,
                entry.data;
        uint8_t rr[65535];
        size_t rlen = rrset->rk.dname_len + 2 + 2 + 4 + d->rr_len[i];
+       time_t adjust = 0;
        log_assert(dest_len > 0 && dest);
        if(rlen > dest_len) {
                dest[0] = 0;
@@ -286,8 +287,10 @@ int packed_rr_to_string(struct ub_packed_rrset_key* rrset, size_t i,
                memmove(rr+rrset->rk.dname_len, &rrset->rk.type, 2);
        else    sldns_write_uint16(rr+rrset->rk.dname_len, LDNS_RR_TYPE_RRSIG);
        memmove(rr+rrset->rk.dname_len+2, &rrset->rk.rrset_class, 2);
+       adjust = SERVE_ORIGINAL_TTL ? d->ttl_add : now;
+       if (d->rr_ttl[i] < adjust) adjust = d->rr_ttl[i]; /* Prevent negative TTL overflow */
        sldns_write_uint32(rr+rrset->rk.dname_len+4,
-               (uint32_t)(d->rr_ttl[i]-(SERVE_ORIGINAL_TTL ? d->ttl_add : now)));
+               (uint32_t)(d->rr_ttl[i]-adjust));
        memmove(rr+rrset->rk.dname_len+8, d->rr_data[i], d->rr_len[i]);
        if(sldns_wire2str_rr_buf(rr, rlen, dest, dest_len) == -1) {
                log_info("rrbuf failure %d %s", (int)d->rr_len[i], dest);
@@ -333,6 +336,7 @@ packed_rrset_copy_region(struct ub_packed_rrset_key* key,
        struct packed_rrset_data* data = (struct packed_rrset_data*)
                key->entry.data;
        size_t dsize, i;
+       time_t adjust = 0;
        if(!ck)
                return NULL;
        ck->id = key->id;
@@ -351,14 +355,15 @@ packed_rrset_copy_region(struct ub_packed_rrset_key* key,
        ck->entry.data = d;
        packed_rrset_ptr_fixup(d);
        /* make TTLs relative - once per rrset */
+       adjust = SERVE_ORIGINAL_TTL ? data->ttl_add : now;
        for(i=0; i<d->count + d->rrsig_count; i++) {
-               if(d->rr_ttl[i] < now)
+               if(d->rr_ttl[i] < adjust)
                        d->rr_ttl[i] = SERVE_EXPIRED?SERVE_EXPIRED_REPLY_TTL:0;
-               else    d->rr_ttl[i] -= SERVE_ORIGINAL_TTL ? data->ttl_add : now;
+               else    d->rr_ttl[i] -= adjust;
        }
-       if(d->ttl < now)
+       if(d->ttl < adjust)
                d->ttl = SERVE_EXPIRED?SERVE_EXPIRED_REPLY_TTL:0;
-       else    d->ttl -= SERVE_ORIGINAL_TTL ? data->ttl_add : now;
+       else    d->ttl -= adjust;
        d->ttl_add = 0; /* TTLs have been made relative */
        return ck;
 }