WMM: Fix estimated medium time calculation for some corner cases

It was possible for the int medium_time variable to overflow, so use a
64-bit unsigned integer to get a large enough value for the
multiplication.

Signed-off-by: Jouni Malinen <j@w1.fi>

diff --git a/src/ap/wmm.c b/src/ap/wmm.c
index 7ecba70f305be16ab6c1469bc11a431973f9bf0c..8054c5d2f2433777f1c86caf638f8da3c7be88d0 100644 (file)
--- a/src/ap/wmm.c
+++ b/src/ap/wmm.c
@@ -152,8 +152,9 @@ static void wmm_send_action(struct hostapd_data *hapd, const u8 *addr,
 
 int wmm_process_tspec(struct wmm_tspec_element *tspec)
 {
-       int medium_time, pps, duration;
-       int up, psb, dir, tid;
+       u64 medium_time;
+       unsigned int pps, duration;
+       unsigned int up, psb, dir, tid;
        u16 val, surplus;
 
        up = (tspec->ts_info[1] >> 3) & 0x07;
@@ -201,8 +202,9 @@ int wmm_process_tspec(struct wmm_tspec_element *tspec)
                return WMM_ADDTS_STATUS_INVALID_PARAMETERS;
        }
 
-       medium_time = surplus * pps * duration / 0x2000;
-       wpa_printf(MSG_DEBUG, "WMM: Estimated medium time: %u", medium_time);
+       medium_time = (u64) surplus * pps * duration / 0x2000;
+       wpa_printf(MSG_DEBUG, "WMM: Estimated medium time: %lu",
+                  (unsigned long) medium_time);
 
        /*
         * TODO: store list of granted (and still active) TSPECs and check