From 62807654a03cd4e511be7e1124f227ad2a92f756 Mon Sep 17 00:00:00 2001 From: Rob Crittenden Date: Thu, 31 Mar 2022 13:40:40 -0400 Subject: [PATCH] kdb: The jitter offset should always be positive Otherwise the resulting value could be outside the valid bounds of the time value. Related: https://pagure.io/freeipa/issue/9121 Signed-off-by: Rob Crittenden Reviewed-By: Alexander Bokovoy --- daemons/ipa-kdb/ipa_kdb_kdcpolicy.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/daemons/ipa-kdb/ipa_kdb_kdcpolicy.c b/daemons/ipa-kdb/ipa_kdb_kdcpolicy.c index b65dd72f6..fa0c5cd37 100644 --- a/daemons/ipa-kdb/ipa_kdb_kdcpolicy.c +++ b/daemons/ipa-kdb/ipa_kdb_kdcpolicy.c @@ -40,7 +40,7 @@ jitter(krb5_deltat baseline, krb5_deltat *lifetime_out) return; } - *lifetime_out = baseline - offset % JITTER_WINDOW_SECONDS; + *lifetime_out = baseline - abs(offset) % JITTER_WINDOW_SECONDS; } static krb5_error_code