diff --git a/third_party/tcplp/bsdtcp/tcp_input.c b/third_party/tcplp/bsdtcp/tcp_input.c index acd933cde..d79f2d2f3 100644 --- a/third_party/tcplp/bsdtcp/tcp_input.c +++ b/third_party/tcplp/bsdtcp/tcp_input.c @@ -241,8 +241,12 @@ cc_cong_signal(struct tcpcb *tp, struct tcphdr *th, uint32_t type) tp->t_dupacks = 0; tp->t_bytes_acked = 0; EXIT_RECOVERY(tp->t_flags); + /* + * samkumar: I added the cast to uint64_t below to fix an OpenThread + * code scanning alert relating to integer overflow in multiplication. + */ tp->snd_ssthresh = max(2, min(tp->snd_wnd, tp->snd_cwnd) / 2 / - tp->t_maxseg) * tp->t_maxseg; + tp->t_maxseg) * ((uint64_t) tp->t_maxseg); tp->snd_cwnd = tp->t_maxseg; /* @@ -2013,9 +2017,14 @@ tcp_do_segment(struct ip6_hdr* ip6, struct tcphdr *th, otMessage* msg, tp->snd_nxt = th->th_ack; tp->snd_cwnd = tp->t_maxseg; (void) tcp_output(tp); + /* + * samkumar: I added casts to uint64_t below to + * fix an OpenThread code scanning alert relating + * to integer overflow in multiplication. + */ tp->snd_cwnd = tp->snd_ssthresh + - tp->t_maxseg * - (tp->t_dupacks - tp->snd_limited); + ((uint64_t) tp->t_maxseg) * + ((uint64_t) (tp->t_dupacks - tp->snd_limited)); #ifdef INSTRUMENT_TCP tcplp_sys_log("TCP SET_cwnd %d", (int) tp->snd_cwnd); #endif