Validate a TimeSpec before using it.

Both tv_sec and tv_nsec should be positive and tv_nec < 1000000000.

Found by the ZeroPath AI Security Engineer <https://zeropath.com>

Author: millert

logsrvd/logsrvd.c

@@ -627,7 +627,7 @@ handle_restart(const RestartMessage *msg, const uint8_t *buf, size_t len,
     }
 
     /* Check that message is valid. */
-    if (msg == NULL || msg->log_id[0] == '\0' || msg->resume_point == NULL) {
+    if (msg == NULL || msg->log_id[0] == '\0' || !valid_timespec(msg->resume_point)) {
 	sudo_warnx(U_("%s: %s"), source, U_("invalid RestartMessage"));
 	closure->errstr = _("invalid RestartMessage");
 	debug_return_bool(false);
@@ -711,11 +711,12 @@ handle_iobuf(int iofd, const IoBuffer *iobuf, const uint8_t *buf, size_t len,
     }
 
     /* Check that message is valid. */
-    if (iobuf == NULL || iobuf->delay == NULL || iobuf->data.len == 0) {
+    if (iobuf == NULL || iobuf->data.len == 0 || !valid_timespec(iobuf->delay)) {
 	sudo_warnx(U_("%s: %s"), source, U_("invalid IoBuffer"));
 	closure->errstr = _("invalid IoBuffer");
 	debug_return_bool(false);
     }
+
     sudo_debug_printf(SUDO_DEBUG_INFO, "%s: received IoBuffer from %s",
 	source, __func__);
 
@@ -758,7 +759,7 @@ handle_winsize(const ChangeWindowSize *msg, const uint8_t *buf, size_t len,
     }
 
     /* Check that message is valid. */
-    if (msg == NULL || msg->delay == NULL) {
+    if (msg == NULL || !valid_timespec(msg->delay)) {
 	sudo_warnx(U_("%s: %s"), source, U_("invalid ChangeWindowSize"));
 	closure->errstr = _("invalid ChangeWindowSize");
 	debug_return_bool(false);
@@ -794,7 +795,7 @@ handle_suspend(const CommandSuspend *msg, const uint8_t *buf, size_t len,
     }
 
     /* Check that message is valid. */
-    if (msg == NULL || msg->delay == NULL) {
+    if (msg == NULL || !valid_timespec(msg->delay)) {
 	sudo_warnx(U_("%s: %s"), source, U_("invalid CommandSuspend"));
 	closure->errstr = _("invalid CommandSuspend");
 	debug_return_bool(false);

logsrvd/logsrvd.h

@@ -46,6 +46,9 @@
 /* Shutdown timeout (in seconds) in case client connections time out. */
 #define SHUTDOWN_TIMEO	10
 
+#define valid_timespec(ts) ((ts) != NULL && \
+    (ts)->tv_sec >= 0 && (ts)->tv_nsec >= 0 && (ts)->tv_nsec < 1000000000)
+
 /*
  * Connection status.
  * In the RUNNING state we expect I/O log buffers.