main: prevent integer overflow when parsing -t timeout argument

The expression `1000 * strtol(optarg, NULL, 0)` multiplies into an
int before the range check at line 91 runs.  A value such as 3000000
overflows int32 and produces a small positive number that passes the
subsequent validity check, resulting in a silently wrong timeout.

Validate the raw seconds value (1–600) before scaling to milliseconds
so the multiplication is provably within int range.

Assisted-by: Claude:claude-sonnet-4-6
Link: https://github.com/openwrt/rpcd/pull/34
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>

1 files changed, 4 insertions, 2 deletions

diff --git a/main.c b/main.c
index d77a814..824ab4a 100644
--- a/main.c
+++ b/main.c
@@ -79,9 +79,11 @@ int main(int argc, char **argv)
 			ubus_socket = optarg;
 			break;
 
-		case 't':
-			rpc_exec_timeout = 1000 * strtol(optarg, NULL, 0);
+		case 't': {
+			long t = strtol(optarg, NULL, 0);
+			rpc_exec_timeout = (t > 0 && t <= 600) ? (int)(t * 1000) : -1;
 			break;
+		}
 
 		default:
 			break;