From d0dcfda4bf006be3099e755ab5ff17477bb9c2b6 Mon Sep 17 00:00:00 2001
From: jjsch-dev <juanjoseschiavoni@hotmail.com>
Date: Fri, 17 Apr 2026 01:55:45 -0300
Subject: [PATCH] fix(lwip): prevent integer overflow in sys_arch_sem_wait
 timeout

---
 components/lwip/port/freertos/sys_arch.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/components/lwip/port/freertos/sys_arch.c b/components/lwip/port/freertos/sys_arch.c
index fdbdf6d51e9..cad2ff12437 100644
--- a/components/lwip/port/freertos/sys_arch.c
+++ b/components/lwip/port/freertos/sys_arch.c
@@ -164,8 +164,12 @@ u32_t
 sys_arch_sem_wait(sys_sem_t *sem, u32_t timeout)
 {
   BaseType_t ret;
-
-  if (!timeout) {
+  /* * Protect against Integer Overflow:
+   * If timeout is 0 (LwIP infinite wait), or if it's so large that adding
+   * portTICK_PERIOD_MS would overflow the 32-bit unsigned integer,
+   * we force it to wait infinitely.
+   */
+  if (!timeout || timeout >= (UINT32_MAX - portTICK_PERIOD_MS)) {
     /* wait infinite */
     ret = xSemaphoreTake((QueueHandle_t)sem, portMAX_DELAY);
     LWIP_ASSERT("taking semaphore failed", ret == pdTRUE);