From 903f43ce6d983e1f29b25c99cde7146e7f168b9b Mon Sep 17 00:00:00 2001
From: John Ferlan <jferlan@redhat.com>
Date: Tue, 5 Feb 2013 17:58:25 -0500
Subject: [PATCH] keepalive: Guard against integer overflow

Don't allow interval to be > MAX_INT/1000 in virKeepAliveStart()

Guard against possible overflow in virKeepAliveTimeout() by setting the
timeout to be MAX_INT/1000 since the math following will multiply it by 1000.
---
 src/rpc/virkeepalive.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/src/rpc/virkeepalive.c b/src/rpc/virkeepalive.c
index d1fa642fd2..71dd904b38 100644
--- a/src/rpc/virkeepalive.c
+++ b/src/rpc/virkeepalive.c
@@ -252,6 +252,12 @@ virKeepAliveStart(virKeepAlivePtr ka,
                            _("keepalive interval already set"));
             goto cleanup;
         }
+        /* Guard against overflow */
+        if (interval > INT_MAX / 1000) {
+            virReportError(VIR_ERR_INTERNAL_ERROR,
+                           _("keepalive interval %d too large"), interval);
+            goto cleanup;
+        }
         ka->interval = interval;
         ka->count = count;
         ka->countToDeath = count;
@@ -323,6 +329,9 @@ virKeepAliveTimeout(virKeepAlivePtr ka)
         timeout = ka->interval - (time(NULL) - ka->intervalStart);
         if (timeout < 0)
             timeout = 0;
+        /* Guard against overflow */
+        if (timeout > INT_MAX / 1000)
+            timeout = INT_MAX / 1000;
     }
 
     virObjectUnlock(ka);