Setting a very high max-age value for Cache-Control causes int overflow

[hyphenized@…]

When proxying to a ruby on rails application, it is possible to receive 100 years (in seconds) as the max age value for the purpose of caching the response forever. In such cases, when nginx parses the value, it ends up being negative thus marking all cache responses as EXPIRED.

According to the spec​https://datatracker.ietf.org/doc/html/rfc7234#section-1.2.1

   the cache must consider the
   value to be either 2147483648 (2^31) or the greatest positive integer
   it can conveniently represent

I think the issue might be somewhere near ​https://github.com/nginx/nginx/blob/master/src/http/ngx_http_upstream.c#L4761 .

[hyphenized@…]

My bad, this is the result for nginx -V

nginx version: nginx/1.20.2
built by cl 16.00.40219.01 for 80x86
built with OpenSSL 1.1.1l  24 Aug 2021
TLS SNI support enabled
configure arguments: --with-cc=cl --builddir=objs.msvc8 --with-debug --prefix= --conf-path=conf/nginx.conf --pid-path=logs/nginx.pid --http-log-path=logs/access.log --error-log-path=logs/error.log --sbin-path=nginx.exe --http-client-body-temp-path=temp/client_body_temp --http-proxy-temp-path=temp/proxy_temp --http-fastcgi-temp-path=temp/fastcgi_temp --http-scgi-temp-path=temp/scgi_temp --http-uwsgi-temp-path=temp/uwsgi_temp --with-cc-opt=-DFD_SETSIZE=1024 --with-pcre=objs.msvc8/lib/pcre-8.44 --with-zlib=objs.msvc8/lib/zlib-1.2.11 --with-http_v2_module --with-http_realip_module --with-http_addition_module --with-http_sub_module --with-http_dav_module --with-http_stub_status_module --with-http_flv_module --with-http_mp4_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_auth_request_module --with-http_random_index_module --with-http_secure_link_module --with-http_slice_module --with-mail --with-stream --with-openssl=objs.msvc8/lib/openssl-1.1.1l --with-openssl-opt='no-asm no-tests -D_WIN32_WINNT=0x0501' --with-http_ssl_module --with-mail_ssl_module --with-stream_ssl_module

[Maxim Dounin]

The maximum supported expiration time is limited by the size of time_t, and on most 32-bit platforms, including Windows, this means that only dates up to 2038 are supported. If you have to use higher expiration times for some reason, you have to switch to a 64-bit platform.

Note that standard Windows binaries as shipped on nginx.org are currently 32-bit, see #1391. If you need a 64-bit Windows binary, see ​here for instructions on how to build it yourself.