From: Nikos Mavrogiannopoulos <nmav@gnutls.org>
Date: Sat, 16 Nov 2013 09:22:22 +0000 (+0100)
Subject: Check for overflows when setting time and allow a time of -1.
X-Git-Tag: gnutls_3_3_0pre0~591
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=8158f413eca449f2c3f6be4b9860707a62fd4d7e;p=thirdparty%2Fgnutls.git

Check for overflows when setting time and allow a time of -1.
---

diff --git a/src/certtool-args.def b/src/certtool-args.def
index 36f0629b0d..bd512a51b5 100644
--- a/src/certtool-args.def
+++ b/src/certtool-args.def
@@ -579,6 +579,7 @@ cn = "Cindy Lauper"
 serial = 007
 
 # In how many days, counting from today, this certificate will expire.
+# Use -1 if there is no expiration date.
 expiration_days = 700
 
 # X.509 v3 extensions
diff --git a/src/certtool-cfg.c b/src/certtool-cfg.c
index da95738d96..747c4b7986 100644
--- a/src/certtool-cfg.c
+++ b/src/certtool-cfg.c
@@ -842,7 +842,7 @@ int get_days(void)
 	int days;
 
 	if (batch) {
-		if (cfg.expiration_days <= 0)
+		if (cfg.expiration_days == 0 || cfg.expiration_days < -2)
 			return 365;
 		else
 			return cfg.expiration_days;
diff --git a/src/certtool.c b/src/certtool.c
index 9f0c74443f..83a25491b3 100644
--- a/src/certtool.c
+++ b/src/certtool.c
@@ -38,6 +38,7 @@
 #include <sys/types.h>
 #include <sys/stat.h>
 #include <fcntl.h>
+#include <intprops.h>
 
 /* Gnulib portability files. */
 #include <read-file.h>
@@ -328,17 +329,28 @@ generate_certificate(gnutls_privkey_t * ret_key,
 	if (!batch)
 		fprintf(stderr, "\n\nActivation/Expiration time.\n");
 
-	gnutls_x509_crt_set_activation_time(crt, time(NULL));
-
 	now = time(NULL);
 
-	do {
-		days = get_days();
-		secs = days * 24 * 60 * 60 + now;
-	}
-	while (secs < now
-	       || (unsigned) (secs - now) / (24 * 60 * 60) !=
-	       (unsigned) days);
+	gnutls_x509_crt_set_activation_time(crt, now);
+
+	days = get_days();
+	secs = days;
+
+	if (secs != (time_t)-1) {
+	        if (INT_MULTIPLY_OVERFLOW(secs, 24*60*60)) {
+	                secs = -1;
+	        } else {
+	                secs *= 24*60*60;
+	        }
+        }
+
+	if (secs != (time_t)-1) {
+	        if (INT_ADD_OVERFLOW(secs, now)) {
+	                secs = -1;
+	        } else {
+	                secs += now;
+	        }
+        }
 
 	result = gnutls_x509_crt_set_expiration_time(crt, secs);
 	if (result < 0) {