[Xymon] Integer overflow in client-side files check

[Axel Beckert]

Hi,

occassionally determining which file to check takes so long that the
file has been modified already after the "files" check started but
before the file timestamp is actually checked. Hence the file might
have a negative age.

But since the variable where this is stored seems to be unsigned, 
this causes false positives due to an integer overflow:

> red /nf/2019/05/03/201905032050
> File was modified 4294967291 seconds ago - should be <360
> File was modified 4294967291 seconds ago - should be <960

This probably only happens if the file to check first has to be found
using backticks or $(...) -- which may take some time.

In our case the according line in client-local.cfg looks like this:

file:`ls -1 $(ls -1d /nf/2???/??/??/ | tail -1)* | tail -1`

Timing examples:

> $ time ls -1 $(ls -1d /nf/2???/??/??/ | tail -1)* | tail -1
> /nf/2019/05/03/201905032055
> 
> real    0m0.015s
> user    0m0.003s
> sys     0m0.004s

I see several potential solutions in decreasing preference:

A) Don't compare to the check startup time but always to the time at
   which the file timestamp is checked.

B) Use a signed integer instead of an unsigned integer.

C) Ignore timestamps newer than "now" when comparing with "<".

Actually IMHO the proper fix would be to implement both, A and B.

P.S.: Happens with 4.3.28 installed from Debian Stretch's xymon
package. Haven't checked with the 4.3.29 branch, but there was nothing
related listed in 4.3.29's Changes file so far.

		Kind regards, Axel
-- 
PGP: 2FF9CD59612616B5      /~\  Plain Text Ribbon Campaign, http://arc.pasp.de/
Mail: abe at deuxchevaux.org  \ /  Say No to HTML in E-Mail and Usenet
Mail+Jabber: abe at noone.org  X
https://axel.beckert.ch/   / \  I love long mails: https://email.is-not-s.ms/