Rewrite timeout computation in a way that is less prone to overflow.

(Problem reported by Peter Sylvester.)

diff --git a/ssl/ssl_sess.c b/ssl/ssl_sess.c
index 5f12aa361c148d8be3b5b8c0f3f9d5dcdc1a1f08..868a207a1f7cfeaca3777fcd32d375e199e0febd 100644 (file)
--- a/ssl/ssl_sess.c
+++ b/ssl/ssl_sess.c
@@ -377,7 +377,7 @@ int ssl_get_prev_session(SSL *s, unsigned char *session_id, int len)
        CRYPTO_add(&ret->references,1,CRYPTO_LOCK_SSL_SESSION);
 #endif
 
-       if ((long)(ret->time+ret->timeout) < (long)time(NULL)) /* timeout */
+       if (ret->timeout < (long)(time(NULL) - ret->time)) /* timeout */
                {
                s->ctx->stats.sess_timeout++;
                /* remove it from the cache */