From: Nick Mathewson <nickm@torproject.org>
Date: Mon, 7 Nov 2016 14:58:29 +0000 (-0500)
Subject: Avoid integer overflow in delay calculation.
X-Git-Tag: tor-0.2.9.5-alpha~9^2^2~2
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=1fdf6e5814ae50ed93338644f97c65b497463141;p=thirdparty%2Ftor.git

Avoid integer overflow in delay calculation.
---

diff --git a/src/or/directory.c b/src/or/directory.c
index d1333a8666..f83f622030 100644
--- a/src/or/directory.c
+++ b/src/or/directory.c
@@ -3796,11 +3796,15 @@ next_random_exponential_delay(int delay, int max_delay)
 
   /* How much are we willing to add to the delay? */
   int max_increment;
+  const int multiplier = 4; /* no more than quintuple. */
 
-  if (delay)
-    max_increment = delay * 4; /* no more than quintuple. */
-  else
+  if (delay && delay < (INT_MAX-1) / multiplier) {
+    max_increment = delay * multiplier;
+  } else if (delay) {
+    max_increment = INT_MAX-1;
+  } else {
     max_increment = 1; /* we're always willing to slow down a little. */
+  }
 
   /* the + 1 here is so that we include the end of the interval */
   int increment = crypto_rand_int(max_increment+1);