fix: assorted numeric overflow fixes by andrewwhitecdw · Pull Request #2462 · NVIDIA/OpenShell

andrewwhitecdw · 2026-07-24T10:29:12Z

Summary

Eight small, independent numeric overflow/underflow fixes in production code paths that handle user or external configuration values:

server: SSH session TTL calculation cast a u64 to i64 and multiplied by 1000, overflowing for large configured TTLs.
driver-podman: Health-check interval multiplied a u64 seconds value by 1_000_000_000, overflowing for huge intervals.
cli: parse_duration_to_ms multiplied the parsed i64 by a fixed multiplier, overflowing for inputs like 100000000000000h.
cli: openshell logs --since <duration> subtracted the parsed duration from now_ms, underflowing when the duration exceeded the current Unix epoch.
tui: format_age subtracted created_secs from now before checking for a future timestamp, so clock-skewed/future values underflowed before the guard could return "-".
driver-podman: parse_cpu_to_microseconds checked that cores was finite, but cores * 100_000 could overflow to infinity and saturate to u64::MAX.
driver-docker: parse_cpu_limit multiplied parsed cores by 1_000_000_000; huge inputs overflowed to infinity and saturated to i64::MAX.
driver-docker: parse_memory_limit multiplied parsed amount by a suffix multiplier; huge inputs overflowed to infinity and saturated to i64::MAX.

Related Issue

N/A — small fixes found during code review.

Changes

sandbox.rs: i64::try_from(...).unwrap_or(i64::MAX).saturating_mul(1000), then saturating_add
container.rs (podman): saturating_mul(1_000_000_000) for health-check interval; reject non-finite or oversized CPU quota products
commands/common.rs: checked_mul in parse_duration_to_ms; regression test
run.rs: saturating_sub for --since start timestamp
lib.rs (tui): guard created_secs > now before subtracting in format_age; regression tests
lib.rs + tests.rs (docker): reject non-finite or out-of-range CPU/memory limit products; regression tests

Testing

mise run pre-commit passes (mise unavailable in this environment; ran equivalent cargo fmt + cargo clippy --all-targets on all touched crates — clean)
Unit tests added/updated and passing:
- cargo test -p openshell-cli parse_duration_to_ms_rejects_overflow → passed
- cargo test -p openshell-tui format_age → 2 passed
- cargo test -p openshell-driver-podman parse_cpu → 5 passed
- cargo test -p openshell-driver-docker parse_cpu_limit → 2 passed
- cargo test -p openshell-driver-docker parse_memory_limit → 2 passed
E2E tests added/updated (if applicable)

Checklist

Follows Conventional Commits
Commits are signed off (DCO)
Architecture docs updated (if applicable)

The SSH session expiry calculation cast a u64 TTL to i64 and multiplied by 1000 without bounds checking. A configured TTL larger than i64::MAX / 1000 overflows and panics in debug builds. Use i64::try_from with saturating_mul and saturating_add so any out-of-range TTL clamps to i64::MAX milliseconds. Signed-off-by: Andrew White <andrewh@cdw.com>

The Podman health-check interval multiplied a u64 seconds value by 1_000_000_000 to produce nanoseconds. A configured interval above u64::MAX / 1e9 overflows. Use saturating_mul so huge values clamp to u64::MAX nanoseconds instead of panicking. Signed-off-by: Andrew White <andrewh@cdw.com>

parse_duration_to_ms parsed the numeric part as i64 and multiplied it by a fixed multiplier, which can overflow for large user inputs such as '100000000000000h'. Use checked_mul and return a clear error instead of panicking. Add a regression test. Signed-off-by: Andrew White <andrewh@cdw.com>

After parsing a duration, the CLI subtracted it from the current Unix epoch milliseconds. A duration larger than now_ms underflows. Use saturating_sub so the start timestamp clamps to 0 instead of panicking in debug builds. Signed-off-by: Andrew White <andrewh@cdw.com>

format_age subtracted created_secs from now before checking whether the timestamp was in the future, so a future or skewed timestamp underflowed before the guard could return '-'. Check created_secs > now before subtracting, and add regression tests for future, zero, and negative timestamps. Signed-off-by: Andrew White <andrewh@cdw.com>

copy-pr-bot · 2026-07-24T10:29:16Z

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

andrewwhitecdw · 2026-07-24T10:29:20Z

I have read the DCO document and I hereby sign the DCO.

parse_cpu_to_microseconds checked that the input cores value was finite, but the product cores * 100_000 could still overflow to infinity (e.g. '1e300'). An infinite product cast to u64 saturates to u64::MAX, producing a bogus quota. Reject the value when the product is non-finite or exceeds u64::MAX. Add a regression test. Signed-off-by: Andrew White <andrewh@cdw.com>

parse_cpu_limit and parse_memory_limit parsed user-supplied f64 values and multiplied them by large constants before casting to i64. A huge input could make the product infinite, silently saturating to i64::MAX. Check that the rounded product is finite and within i64 range before casting, and return a clear failed-precondition error. Add regression tests. Signed-off-by: Andrew White <andrewh@cdw.com>

johntmyers

gator-agent

PR Review Status

Validation: This is project-valid small, concentrated numeric-safety work across existing CLI, TUI, server, Docker, and Podman paths.
Head SHA: 260664b542b829e612093b7ed7e617192daed804

Review findings:

The Docker millicore path still uses saturating_mul(1_000_000), so oversized millicore input silently clamps while the equivalent core input errors. Please use checked multiplication, return the same “too large” error, and add a regression test.
Four line-specific boundary findings are included inline.

Docs: No Fern update is needed for the current arithmetic-only changes. If remediation introduces a documented maximum Podman health-check interval, update docs/reference/gateway-config.mdx.

E2E: Deferred until review findings are resolved; the current patch is arithmetic-only and focused boundary unit tests are sufficient.

Next state: gator:in-review

johntmyers · 2026-07-24T18:19:40Z

-    Ok(Some((cores * 1_000_000_000.0).round() as i64))
+    let nano_cpus = (cores * 1_000_000_000.0).round();
+    #[allow(clippy::cast_precision_loss)]
+    if !nano_cpus.is_finite() || nano_cpus < i64::MIN as f64 || nano_cpus > i64::MAX as f64 {


gator-agent

Warning (CWE-190): i64::MAX as f64 rounds to 2^63, so an intermediate equal to 2^63 passes this > check and the cast silently saturates to i64::MAX. Reject this boundary (for example with >=) or use an exact checked conversion, and add a 2^63 regression test.

johntmyers · 2026-07-24T18:19:40Z

-    Ok(Some((amount * multiplier).round() as i64))
+    let bytes = (amount * multiplier).round();
+    #[allow(clippy::cast_precision_loss)]
+    if !bytes.is_finite() || bytes < i64::MIN as f64 || bytes > i64::MAX as f64 {


gator-agent

Warning (CWE-190): The same 2^63 boundary issue applies here: a quantity producing exactly 2^63 bytes passes validation and clamps to i64::MAX. Reject equality or use an exact checked conversion, with a boundary regression test.

johntmyers · 2026-07-24T18:19:40Z

        }
+        let micros_f = cores * 100_000.0;
+        #[allow(clippy::cast_precision_loss)]
+        if !micros_f.is_finite() || micros_f > u64::MAX as f64 {


gator-agent

Warning (CWE-190): u64::MAX as f64 rounds to 2^64, so an intermediate equal to 2^64 passes this check and the cast saturates to u64::MAX. Reject this boundary (for example with >=) or use checked exact parsing, and test the 2^64 boundary.

johntmyers · 2026-07-24T18:19:40Z

-            interval: config.health_check_interval_secs * 1_000_000_000,
+            interval: config
+                .health_check_interval_secs
+                .saturating_mul(1_000_000_000),


gator-agent

Warning (CWE-190): saturating_mul converts overflow to u64::MAX, but Podman’s inherited health-check interval uses a signed Go time.Duration in nanoseconds. Invalid configuration can therefore survive startup and fail later during sandbox creation. Validate the interval against i64::MAX / 1_000_000_000 during driver initialization, use checked multiplication, and add a boundary test.

johntmyers · 2026-07-25T00:00:10Z

/ok to test 260664b

Addresses gator-agent review feedback on NVIDIA#2462: - Docker parse_cpu_limit / parse_memory_limit: use >= i64::MAX as f64 so inputs rounding to 2^63 are rejected instead of saturating. - Podman parse_cpu_to_microseconds: use >= u64::MAX as f64 so inputs rounding to 2^64 are rejected instead of saturating. - Podman health-check interval: replace saturating_mul with checked_mul and reject values exceeding i64::MAX nanoseconds. - Add regression tests for the i64::MAX, u64::MAX, and health-check interval boundaries. Signed-off-by: Andrew White <andrewh@cdw.com>

johntmyers

gator-agent

PR Review Status

Validation: This remains project-valid, concentrated numeric-safety work across existing CLI, TUI, server, Docker, and Podman paths.
Head SHA: 04139ebeb6c91f7ef3b69b9fc384bb8d57f2e8ea

Thanks @andrewwhitecdw. I checked the latest commit against each prior finding. The Docker memory boundary and Podman health-check bound are resolved, and the Docker/Podman floating-point guards now reject equality. However, two new tests do not exercise the equality values they claim, and the earlier Docker millicore finding remains unresolved at crates/openshell-driver-docker/src/lib.rs:2678: saturating_mul(1_000_000) still silently maps oversized input to i64::MAX. Replace it with checked multiplication, return the existing “too large” error, and test 9223372036855m as rejected while 9223372036854m remains accepted.

Four additional line-specific findings are included inline. No Fern docs update is needed for these arithmetic-only changes. E2E is not required; focused boundary unit coverage is appropriate.

Next state: gator:in-review

johntmyers · 2026-07-28T20:14:46Z

        )
        .into_diagnostic()?;
-        now_ms - dur_ms
+        now_ms.saturating_sub(dur_ms)


gator-agent

Warning: saturating_sub does not clamp a duration older than the Unix epoch to zero; it returns a negative timestamp whenever the subtraction remains representable. Negative durations are also accepted and produce future timestamps. Reject negative durations, then clamp an overlong duration to zero (for example, now_ms.checked_sub(dur_ms).unwrap_or(0).max(0)) and add regression tests for both cases.

johntmyers · 2026-07-28T20:14:46Z

+fn parse_cpu_limit_rejects_i64_max_boundary() {
+    // 9_223_372_037 cores * 1e9 rounds to 2^63, which used to pass the > check
+    // and silently saturate to i64::MAX. It must now be rejected.
+    let err = parse_cpu_limit("9223372037").unwrap_err();


gator-agent

Warning: This does not test the equality boundary: 9_223_372_037 * 1e9 is already above 2^63, so changing the guard back from >= to > would still pass. Test 9223372036.854776, whose floating-point product rounds exactly to 2^63.

johntmyers · 2026-07-28T20:14:46Z

+        // 184_467_440_737_095_520 cores * 100_000 rounds to 2^64, which used
+        // to pass the > check and silently saturate to u64::MAX. It must now
+        // be rejected.
+        assert_eq!(parse_cpu_to_microseconds("184467440737095520"), None);


gator-agent

Warning: This input is approximately 1,000 times the 2^64 boundary, contrary to the comment, so it does not protect the >= regression. Use 184467440737095.51616; multiplying that parsed value by 100_000 rounds to exactly 2^64.

johntmyers · 2026-07-28T20:14:46Z

    let now_ms = current_time_ms();
    let expires_at_ms = if state.config.ssh_session_ttl_secs > 0 {
-        now_ms + (state.config.ssh_session_ttl_secs as i64 * 1000)
+        let ttl_ms = i64::try_from(state.config.ssh_session_ttl_secs)


gator-agent

Warning (CWE-20/CWE-613): Saturating an unrepresentable TTL to i64::MAX silently turns invalid configuration into a practically non-expiring SSH credential. Validate the TTL with checked conversion, multiplication, and addition, return an error when it cannot be represented, and add a boundary test.

andrewwhitecdw added 5 commits July 24, 2026 05:28

andrewwhitecdw requested review from a team, derekwaynecarr, maxamillion and mrunalp as code owners July 24, 2026 10:29

andrewwhitecdw added 2 commits July 24, 2026 05:42

andrewwhitecdw changed the title ~~fix: assorted signed/unsigned integer overflow fixes~~ fix: assorted numeric overflow fixes Jul 24, 2026

johntmyers reviewed Jul 24, 2026

View reviewed changes

johntmyers added the gator:in-review Gator is reviewing or awaiting PR review feedback label Jul 24, 2026

andrewwhitecdw mentioned this pull request Jul 28, 2026

fix(supervisor-network): L7 endpoint validation edge cases #2464

Open

6 tasks

johntmyers reviewed Jul 28, 2026

View reviewed changes

Uh oh!

Conversation

andrewwhitecdw commented Jul 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Related Issue

Changes

Testing

Checklist

Uh oh!

copy-pr-bot Bot commented Jul 24, 2026

Uh oh!

andrewwhitecdw commented Jul 24, 2026

Uh oh!

johntmyers left a comment

Choose a reason for hiding this comment

PR Review Status

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

johntmyers commented Jul 25, 2026

Uh oh!

johntmyers left a comment

Choose a reason for hiding this comment

PR Review Status

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

andrewwhitecdw commented Jul 24, 2026 •

edited

Loading