Skip to content

Audit Year-2038-sensitive persisted and runtime timestamps

Summary

Audit persisted and runtime timestamp paths that can become Year-2038-sensitive, especially where values are narrowed to 32-bit fields for Kad, known-file, or metadata compatibility.

This is deferred hardening, not a beta 0.7.3 release blocker.

Current Mainline Evidence

The active Windows x64 build uses a 64-bit time_t, which reduces immediate runtime risk. However, compatibility file formats and protocol-adjacent state still contain explicit 32-bit timestamp writes and reads, including Kad index and known-file metadata paths.

Candidate areas:

  • srchybrid/KnownFile.cpp
  • srchybrid/kademlia/kademlia/Indexed.cpp
  • persisted .met compatibility records
  • JSON and UI timestamp formatting paths

Scope

  • Inventory every time_t to uint32 narrowing and every persisted timestamp field with a 2038 boundary.
  • Classify each field as protocol/file-format compatibility, local-only state, UI-only display, or runtime scheduling.
  • Add guards or migration notes for local-only state where widening is safe.
  • Preserve stock/community file and wire compatibility where widening would change externally consumed formats.

Non-Goals

  • Do not change Kad/eD2K wire fields without a compatibility design.
  • Do not rewrite all time handling in one broad refactor.
  • Do not treat upstream wxWidgets-specific Linux behavior as directly applicable to the Windows MFC app.

Upstream Signal

aMule issue #602 reports unresponsive behavior and resource spikes when running after the Year-2038 boundary. The exact wxWidgets failure mode does not map directly to MFC, but the timestamp audit is still relevant for a long-lived P2P client.

Acceptance Criteria

  • [ ] Inventory of all persisted/runtime timestamp narrowing is documented.
  • [ ] Local-only timestamp fields have a safe widening or explicit deferral decision.
  • [ ] Protocol/file-format compatibility fields are documented before any behavior change.
  • [ ] A small test or diagnostic fixture covers representative post-2038 input where it is safe to do so.