From b03c55892acee819abe70acce55e05e4e9ee9135 Mon Sep 17 00:00:00 2001 From: Dave Rodgman Date: Tue, 20 Dec 2022 13:20:01 +0000 Subject: [PATCH 1/2] Fix overflow in mbedtls_timing_hardclock() Signed-off-by: Dave Rodgman --- library/timing.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/library/timing.c b/library/timing.c index 6c14a4fd01..ca29e56a66 100644 --- a/library/timing.c +++ b/library/timing.c @@ -223,7 +223,7 @@ unsigned long mbedtls_timing_hardclock( void ) } gettimeofday( &tv_cur, NULL ); - return( ( tv_cur.tv_sec - tv_init.tv_sec ) * 1000000 + return( ( tv_cur.tv_sec - tv_init.tv_sec ) * 1000000U + ( tv_cur.tv_usec - tv_init.tv_usec ) ); } #endif /* !HAVE_HARDCLOCK */ From e5c5b1d3eaff69912ad6b2292d092fc4e451f948 Mon Sep 17 00:00:00 2001 From: Dave Rodgman Date: Tue, 20 Dec 2022 13:16:34 +0000 Subject: [PATCH 2/2] Add Changelog entry Signed-off-by: Dave Rodgman --- ChangeLog.d/fix-gettimeofday-overflow.txt | 4 ++++ 1 file changed, 4 insertions(+) create mode 100644 ChangeLog.d/fix-gettimeofday-overflow.txt diff --git a/ChangeLog.d/fix-gettimeofday-overflow.txt b/ChangeLog.d/fix-gettimeofday-overflow.txt new file mode 100644 index 0000000000..99a049d8c8 --- /dev/null +++ b/ChangeLog.d/fix-gettimeofday-overflow.txt @@ -0,0 +1,4 @@ +Bugfix + * Fix possible integer overflow in mbedtls_timing_hardclock(), which + could cause a crash for certain platforms & compiler options. +