integer arithmetic types: correct perhaps-possible negative timeout situation

[secnet.git] / site.c

diff --git a/site.c b/site.c
index e542b7d8173b44ac35ad1aaade05e57d97dbdef2..c2a230383bc3ad45020091726364f26130d849c2 100644 (file)
--- a/site.c
+++ b/site.c
@@ -936,7 +936,8 @@ static inline void site_settimeout(uint64_t timeout, uint64_t *now,
                                   int *timeout_io)
 {
     if (timeout) {
-       uint64_t offset=timeout-*now;
+       int64_t offset=timeout-*now;
+       if (offset<0) offset=0;
        if (offset>INT_MAX) offset=INT_MAX;
        if (*timeout_io<0 || offset<*timeout_io)
            *timeout_io=offset;
@@ -1266,6 +1267,8 @@ static list_t *site_apply(closure_t *self, struct cloc loc, dict_t *context,
     sprintf(st->tunname,"%s<->%s",st->localname,st->remotename);
 
     /* The information we expect to see in incoming messages of type 1 */
+    /* fixme: lots of unchecked overflows here, but the results are only
+       corrupted packets rather than undefined behaviour */
     st->setupsiglen=strlen(st->remotename)+strlen(st->localname)+8;
     st->setupsig=safe_malloc(st->setupsiglen,"site_apply");
     put_uint32(st->setupsig+0,LABEL_MSG1);