From fc399486e9b1cefa07f9ee2da5d516574a9b0575 Mon Sep 17 00:00:00 2001 From: Joel Sing Date: Mon, 21 Jan 2019 11:05:42 +0000 Subject: Explicitly check timegm() return value. Spotted by tb@ ok deraadt@ tb@ --- usr.sbin/ntpd/constraint.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) (limited to 'usr.sbin/ntpd') diff --git a/usr.sbin/ntpd/constraint.c b/usr.sbin/ntpd/constraint.c index 4434a9385e2..48704dd2be7 100644 --- a/usr.sbin/ntpd/constraint.c +++ b/usr.sbin/ntpd/constraint.c @@ -1,4 +1,4 @@ -/* $OpenBSD: constraint.c,v 1.40 2019/01/21 08:38:22 jsing Exp $ */ +/* $OpenBSD: constraint.c,v 1.41 2019/01/21 11:05:41 jsing Exp $ */ /* * Copyright (c) 2015 Reyk Floeter @@ -985,7 +985,8 @@ httpsdate_request(struct httpsdate *httpsdate, struct timeval *when) * TLS handshake, based on the time specified by the server's HTTP Date: * header. */ - httptime = timegm(&httpsdate->tls_tm); + if ((httptime = timegm(&httpsdate->tls_tm)) == -1) + goto fail; if (httptime <= tls_peer_cert_notbefore(httpsdate->tls_ctx) || httptime >= tls_peer_cert_notafter(httpsdate->tls_ctx)) { log_warnx("tls certificate invalid: %s (%s):", -- cgit v1.2.3