[master] address overflow in retry backoff

4877.	[bug]		Address integer overflow when exponentially
			backing off retry intervals. [RT #47041]

diff --git a/CHANGES b/CHANGES
index 164210b5a3fffa73251d10c8b36a8b2d7de87aa7..7f94f85c75fa678b94364a59feee767d86a0cfca 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+4877.  [bug]           Address integer overflow when exponentially
+                       backing off retry intervals. [RT #47041]
+
 4876.  [bug]           Address deadlock with accessing a keytable. [RT #47000]
 
 4875.  [bug]           Address compile failures on older systems. [RT #47015]

diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
index 40f10461ac5472f117390882fe1e2d5d42659589..32bd83f6cfdef762ca7a4af290fd3310a6cab1f7 100644 (file)
--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
@@ -1810,8 +1810,12 @@ fctx_setretryinterval(fetchctx_t *fctx, unsigned int rtt) {
        /*
         * Exponential backoff after the first few tries.
         */
-       if (fctx->restarts > fctx->res->nonbackofftries)
-               us <<= (fctx->restarts - fctx->res->nonbackofftries);
+       if (fctx->restarts > fctx->res->nonbackofftries) {
+               int shift = fctx->restarts - fctx->res->nonbackofftries;
+               if (shift > 6)
+                       shift = 6;
+               us <<= shift;
+       }
 
        /*
         * Add a fudge factor to the expected rtt based on the current