diff options
| author | Tomas Babej <tbabej@redhat.com> | 2013-01-14 10:19:44 -0500 |
|---|---|---|
| committer | Martin Kosek <mkosek@redhat.com> | 2013-02-08 15:54:21 +0100 |
| commit | 0e8a329048629f639ae64ff32e01e12a495e7763 (patch) | |
| tree | 0ad4e0cba576a25639785809bf9f30776adde1d7 /daemons/ipa-kdb/ipa_kdb_passwords.c | |
| parent | 1d35043e466dfca22cdaf463b6623c10a9ff2d39 (diff) | |
| download | freeipa-0e8a329048629f639ae64ff32e01e12a495e7763.tar.gz freeipa-0e8a329048629f639ae64ff32e01e12a495e7763.tar.xz freeipa-0e8a329048629f639ae64ff32e01e12a495e7763.zip | |
Prevent integer overflow when setting krbPasswordExpiration
Since in Kerberos V5 are used 32-bit unix timestamps, setting
maxlife in pwpolicy to values such as 9999 days would cause
integer overflow in krbPasswordExpiration attribute.
This would result into unpredictable behaviour such as users
not being able to log in after password expiration if password
policy was changed (#3114) or new users not being able to log
in at all (#3312).
The timestamp value is truncated to Jan 1, 2038 in ipa-kdc driver.
https://fedorahosted.org/freeipa/ticket/3312
https://fedorahosted.org/freeipa/ticket/3114
Diffstat (limited to 'daemons/ipa-kdb/ipa_kdb_passwords.c')
| -rw-r--r-- | daemons/ipa-kdb/ipa_kdb_passwords.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/daemons/ipa-kdb/ipa_kdb_passwords.c b/daemons/ipa-kdb/ipa_kdb_passwords.c index b6520ea75..974ae8fc8 100644 --- a/daemons/ipa-kdb/ipa_kdb_passwords.c +++ b/daemons/ipa-kdb/ipa_kdb_passwords.c @@ -246,6 +246,11 @@ krb5_error_code ipadb_get_pwd_expiration(krb5_context context, *expire_time = mod_time; } + /* in the case of integer owerflow, set expiration to IPAPWD_END_OF_TIME */ + if ((*expire_time) < 0 || (*expire_time) > IPAPWD_END_OF_TIME) { + *expire_time = IPAPWD_END_OF_TIME; // 1 Jan 2038, 00:00 GMT + } + kerr = 0; done: |