diff mbox series

utils:Fix potential bug in function eloop_register_timeout

Message ID 20210913091415.9118-1-wangxinpeng@uniontech.com
State Accepted
Headers show
Series utils:Fix potential bug in function eloop_register_timeout | expand

Commit Message

xinpeng wang Sept. 13, 2021, 9:14 a.m. UTC 
In the process of processing usec, sec is increased and may overflow.

Signed-off-by: xinpeng wang <wangxinpeng@uniontech.com>
---
 src/utils/eloop.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

Comments

Jouni Malinen Oct. 22, 2021, 5:40 p.m. UTC | #1 
On Mon, Sep 13, 2021 at 05:14:15PM +0800, xinpeng wang wrote:
> In the process of processing usec, sec is increased and may overflow.

Thanks, applied with some cleanup.
diff mbox series

Patch

diff --git a/src/utils/eloop.c b/src/utils/eloop.c
index b353ab0e4..1535e9469 100644
--- a/src/utils/eloop.c
+++ b/src/utils/eloop.c
@@ -800,6 +800,16 @@  int eloop_register_timeout(unsigned int secs, unsigned int usecs,
 		timeout->time.sec++;
 		timeout->time.usec -= 1000000;
 	}
+	if (timeout->time.sec < now_sec) {
+		/*
+		 * Integer overflow - assume long enough timeout to be assumed
+		 * to be infinite, i.e., the timeout would never happen.
+		 */
+		wpa_printf(MSG_DEBUG, "ELOOP: Too long timeout (secs=%u usecs=%u) to "
+			   "ever happen - ignore it", secs,usecs);
+		os_free(timeout);
+		return 0;
+	}
 	timeout->eloop_data = eloop_data;
 	timeout->user_data = user_data;
 	timeout->handler = handler;