[ntpsec commit] Fix signed-to-unsigned cast w/ overflow potential

Daniel Franke dfranke at ntpsec.org
Wed Oct 21 18:36:33 UTC 2015


Module:    ntpsec
Branch:    master
Commit:    c220b63cbc1f4b6525c1217a34950844055ef678
Changeset: http://git.ntpsec.org/ntpsec/commit/?id=c220b63cbc1f4b6525c1217a34950844055ef678

Author:    Daniel Fox Franke <dfoxfranke at gmail.com>
Date:      Tue Oct 20 21:39:36 2015 -0400

Fix signed-to-unsigned cast w/ overflow potential

Discovered by Yves Younan of Cisco Talos and assigned
tracking ID TALOS-CAN-0064.

---

 include/ntp_refclock.h | 2 +-
 ntpd/ntp_io.c          | 8 ++++----
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/include/ntp_refclock.h b/include/ntp_refclock.h
index fa03179..d0b89e7 100644
--- a/include/ntp_refclock.h
+++ b/include/ntp_refclock.h
@@ -99,7 +99,7 @@ struct refclockio {
 				due to small bursts
 				of refclock input data */
 	struct peer *srcclock;	/* refclock peer */
-	u_int	datalen;	/* length of data */
+	size_t	datalen;	/* length of data */
 	int	fd;		/* file descriptor */
 	u_long	recvcount;	/* count of receive completions */
 	bool	active;		/* true when in use */
diff --git a/ntpd/ntp_io.c b/ntpd/ntp_io.c
index aadb548..fc50e74 100644
--- a/ntpd/ntp_io.c
+++ b/ntpd/ntp_io.c
@@ -3227,8 +3227,8 @@ read_refclock_packet(
 	l_fp			ts
 	)
 {
-	int			i;
-	int			buflen;
+	size_t			i;
+	ssize_t			buflen;
 	int			saved_errno;
 	int			consumed;
 	struct recvbuf *	rb;
@@ -3248,10 +3248,10 @@ read_refclock_packet(
 
 	i = (rp->datalen == 0
 	     || rp->datalen > sizeof(rb->recv_space))
-	        ? (int)sizeof(rb->recv_space)
+	        ? sizeof(rb->recv_space)
 		: rp->datalen;
 	do {
-		buflen = read(fd, (char *)&rb->recv_space, (u_int)i);
+		buflen = read(fd, (char *)&rb->recv_space, i);
 	} while (buflen < 0 && EINTR == errno);
 
 	if (buflen <= 0) {



More information about the vc mailing list