From: Miroslav Lichvar <mlichvar@redhat.com>
Date: Wed, 24 Jun 2026 12:31:05 +0000 (+0200)
Subject: refclock: validate normality of SHM and SOCK timestamps
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=f2632909e7758a447afbe483cc2cff5f92bc8ac4;p=thirdparty%2Fchrony.git

refclock: validate normality of SHM and SOCK timestamps

In the SHM and SOCK refclock drivers verify that received timestamps are
normal (microseconds and nanoseconds are in the expected range) to avoid
undefined behavior in their conversion and normalization.
---

diff --git a/refclock_shm.c b/refclock_shm.c
index 38f73376..c3458794 100644
--- a/refclock_shm.c
+++ b/refclock_shm.c
@@ -94,6 +94,7 @@ static void shm_finalise(RCL_Instance instance)
 static int shm_poll(RCL_Instance instance)
 {
   struct timespec receive_ts, clock_ts;
+  struct timeval receive_tv, clock_tv;
   struct shmTime t, *shm;
 
   shm = (struct shmTime *)RCL_GetDriverData(instance);
@@ -109,21 +110,32 @@ static int shm_poll(RCL_Instance instance)
 
   shm->valid = 0;
 
-  receive_ts.tv_sec = t.receiveTimeStampSec;
-  clock_ts.tv_sec = t.clockTimeStampSec;
-
   if (t.clockTimeStampNSec / 1000 == t.clockTimeStampUSec &&
       t.receiveTimeStampNSec / 1000 == t.receiveTimeStampUSec) {
+    receive_ts.tv_sec = t.receiveTimeStampSec;
     receive_ts.tv_nsec = t.receiveTimeStampNSec;
+    clock_ts.tv_sec = t.clockTimeStampSec;
     clock_ts.tv_nsec = t.clockTimeStampNSec;
+
+    if (!UTI_IsTimespecNormal(&receive_ts) || !UTI_IsTimespecNormal(&clock_ts)) {
+      DEBUG_LOG("Invalid timestamp in SHM sample");
+      return 0;
+    }
   } else {
-    receive_ts.tv_nsec = 1000 * t.receiveTimeStampUSec;
-    clock_ts.tv_nsec = 1000 * t.clockTimeStampUSec;
+    receive_tv.tv_sec = t.receiveTimeStampSec;
+    receive_tv.tv_usec = t.receiveTimeStampUSec;
+    clock_tv.tv_sec = t.clockTimeStampSec;
+    clock_tv.tv_usec = t.clockTimeStampUSec;
+
+    if (!UTI_IsTimevalNormal(&receive_tv) || !UTI_IsTimevalNormal(&clock_tv)) {
+      DEBUG_LOG("Invalid timestamp in SHM sample");
+      return 0;
+    }
+
+    UTI_TimevalToTimespec(&receive_tv, &receive_ts);
+    UTI_TimevalToTimespec(&clock_tv, &clock_ts);
   }
 
-  UTI_NormaliseTimespec(&clock_ts);
-  UTI_NormaliseTimespec(&receive_ts);
-
   return RCL_AddSample(instance, &receive_ts, &clock_ts, t.leap, 1);
 }
 
diff --git a/refclock_sock.c b/refclock_sock.c
index da0b0206..a8d04dd8 100644
--- a/refclock_sock.c
+++ b/refclock_sock.c
@@ -126,8 +126,12 @@ static void read_sample(int sockfd, int event, void *anything)
     return;
   }
 
+  if (!UTI_IsTimevalNormal(&sample.tv)) {
+    DEBUG_LOG("Invalid timestamp in SOCK sample");
+    return;
+  }
+
   UTI_TimevalToTimespec(&sample.tv, &sys_ts);
-  UTI_NormaliseTimespec(&sys_ts);
 
   if (!UTI_IsTimeOffsetSane(&sys_ts, sample.offset))
     return;