The 'nexttimer' counter in vireventglib.c is a static int starting at 1,
incremented for every new timeout registration. After running for a long
period (1+ years with frequent client connections), it overflows past
INT_MAX and becomes negative.

A negative timer ID causes multiple issues:
1. virKeepAliveStart: skips virObjectRef(), leaving the keepalive object
   with only 1 reference (should be 2). When the connection closes,
   virObjectUnref() drops refcount to 0, freeing the object while the
   GSource is still active -> use-after-free with 'bad magic number' logs.
2. virKeepAliveStop: skips virEventRemoveTimeout(), the GSource is never
   destroyed, continuing to fire on freed memory.
3. virNetServerClientNew: sockTimer creation fails, all new connections
   rejected with 'Connection reset by peer'.

In production (libvirtd running 1 year 8 months), this caused:
- 1 leaked keepalive GSource (use-after-free, continuous 'bad magic' logs)
- 282 million leaked sockTimer structures (19.6GB RSS)
- All virsh commands failing with 'Connection reset by peer'

Patch 1: Prevent nexttimer overflow in vireventglib.c (root cause fix)
Patch 2: Fix timer ID checks in virkeepalive.c (defensive fix, use
         != -1 instead of > 0 to handle negative IDs)

Yong Chen (2):
  util: Guard against integer overflow in nexttimer
  rpc: Use != -1 instead of > 0 for timer ID checks

 src/rpc/virkeepalive.c  | 14 +++++++++++++-
 src/util/vireventglib.c |  3 +++
 2 files changed, 16 insertions(+), 1 deletion(-)

-- 
2.55.0.windows.3