waitio: Fix timeout integer overflow

Fix integer overflow in apr_wait_for_io_or_timeout by performing the microseconds to milliseconds conversion before assigning to 32-bit timeout.

Author: Alejandro Perez Pestana

support/unix/waitio.c

@@ -36,19 +36,19 @@
 #include <sys/poll.h>
 #endif
 
+/* convert microseconds to milliseconds (round up) */
+#define USEC_TO_MSEC(t) ((t) > 0 ? ((t) + 999) / 1000 : (t))
+
 apr_status_t apr_wait_for_io_or_timeout(apr_file_t *f, apr_socket_t *s,
                                         int for_read)
 {
     struct pollfd pfd;
     int rc, timeout;
 
-    timeout    = f        ? f->timeout        : s->timeout;
-    pfd.fd     = f        ? f->filedes        : s->socketdes;
-    pfd.events = for_read ? POLLIN            : POLLOUT;
+    timeout    = f        ? USEC_TO_MSEC(f->timeout) : USEC_TO_MSEC(s->timeout);
+    pfd.fd     = f        ? f->filedes               : s->socketdes;
+    pfd.events = for_read ? POLLIN                   : POLLOUT;
 
-    if (timeout > 0) {
-        timeout = (timeout + 999) / 1000;
-    }
     do {
         rc = poll(&pfd, 1, timeout);
     } while (rc == -1 && errno == EINTR);