nihilist/tor
1
0
Fork 0
mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2024-11-10 05:03:43 +01:00
Code Issues Packages Projects Releases Wiki Activity

cc: Fix 32bit arithmetic to actually be 64bit

Browse Source 
Coverity report: CID 1492322

________________________________________________________________________________________________________
*** CID 1492322:  Integer handling issues  (OVERFLOW_BEFORE_WIDEN)
/src/core/or/congestion_control_flow.c: 399 in circuit_process_stream_xon()
393       }
394
395       log_info(LD_EDGE, "Got XON: %d", xon->kbps_ewma);
396
397       /* Adjust the token bucket of this edge connection with the drain rate in
398        * the XON. Rate is in bytes from kilobit (kpbs). */
>>>     CID 1492322:  Integer handling issues  (OVERFLOW_BEFORE_WIDEN)
>>>     Potentially overflowing expression "xon_cell_get_kbps_ewma(xon) * 1000U" with type "unsigned int" (32 bits, unsigned) is evaluated using 32-bit arithmetic, and then used in a context that expects an expression of type "uint64_t" (64 bits, unsigned).
399       uint64_t rate = xon_cell_get_kbps_ewma(xon) * 1000;
400       if (rate == 0 || INT32_MAX < rate) {
401         /* No rate. */
402         rate = INT32_MAX;
403       }
404       token_bucket_rw_adjust(&conn->bucket, (uint32_t) rate, (uint32_t) rate);

Fixes #40478

Signed-off-by: David Goulet <dgoulet@torproject.org>
This commit is contained in:
David Goulet 2021-10-05 13:47:49 -04:00
parent 6ada3be8f1
commit cdbf756b90
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/core/or/congestion_control_flow.c
View File

@ -396,7 +396,7 @@ circuit_process_stream_xon(edge_connection_t *conn,
/* Adjust the token bucket of this edge connection with the drain rate in
* the XON. Rate is in bytes from kilobit (kpbs). */
uint64_t rate = xon_cell_get_kbps_ewma(xon) * 1000;
uint64_t rate = ((uint64_t) xon_cell_get_kbps_ewma(xon) * 1000);
if (rate == 0 || INT32_MAX < rate) {
/* No rate. */
rate = INT32_MAX;