From 0d605670309db1c6a30e6c9febf2dbe4fbb34af7 Mon Sep 17 00:00:00 2001 From: Jouni Malinen Date: Sat, 11 Feb 2017 12:09:11 +0200 Subject: [PATCH] WMM: Fix estimated medium time calculation for some corner cases It was possible for the int medium_time variable to overflow, so use a 64-bit unsigned integer to get a large enough value for the multiplication. Signed-off-by: Jouni Malinen --- src/ap/wmm.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/src/ap/wmm.c b/src/ap/wmm.c index 7ecba70f3..8054c5d2f 100644 --- a/src/ap/wmm.c +++ b/src/ap/wmm.c @@ -152,8 +152,9 @@ static void wmm_send_action(struct hostapd_data *hapd, const u8 *addr, int wmm_process_tspec(struct wmm_tspec_element *tspec) { - int medium_time, pps, duration; - int up, psb, dir, tid; + u64 medium_time; + unsigned int pps, duration; + unsigned int up, psb, dir, tid; u16 val, surplus; up = (tspec->ts_info[1] >> 3) & 0x07; @@ -201,8 +202,9 @@ int wmm_process_tspec(struct wmm_tspec_element *tspec) return WMM_ADDTS_STATUS_INVALID_PARAMETERS; } - medium_time = surplus * pps * duration / 0x2000; - wpa_printf(MSG_DEBUG, "WMM: Estimated medium time: %u", medium_time); + medium_time = (u64) surplus * pps * duration / 0x2000; + wpa_printf(MSG_DEBUG, "WMM: Estimated medium time: %lu", + (unsigned long) medium_time); /* * TODO: store list of granted (and still active) TSPECs and check