This is the mail archive of the
glibc-bugs@sourceware.org
mailing list for the glibc project.
[Bug libc/9880] New: fix the total number of ip addrs in Router Header type 0 in inet6_rth_reverse()
- From: "yanghy at cn dot fujitsu dot com" <sourceware-bugzilla at sourceware dot org>
- To: glibc-bugs at sources dot redhat dot com
- Date: 23 Feb 2009 07:35:29 -0000
- Subject: [Bug libc/9880] New: fix the total number of ip addrs in Router Header type 0 in inet6_rth_reverse()
- Reply-to: sourceware-bugzilla at sourceware dot org
The inet6_rth_reverse() is used to reverse the order of the addresses
in the new Routing header, but the total number of ip addrs is miscalculated.
The initial value of segment left is equal to the value of
"ip6r0_len * 8 / sizeof (struct in6_addr)", and the segment left
will decrease to zero until the packet reach the destination.
So, the total ip addrs is equal to "ip6r0_len * 8 / sizeof (struct in6_addr)",
not "ip6r0_segleft * 8 / sizeof (struct in6_addr)" or "ip6r0_segleft".
Signed-off-by: Yang Hongyang <yanghy@cn.fujitsu.com>
--- glibc-2.5-20061008T1257.org/inet/inet6_rth.c 2009-01-11 22:51:33.000000000 +0800
+++ glibc-2.5-20061008T1257/inet/inet6_rth.c 2009-01-11 23:15:23.000000000 +0800
@@ -127,7 +127,7 @@ inet6_rth_reverse (const void *in, void
/* Copy header, not the addresses. The memory regions can overlap. */
memmove (out_rthdr0, in_rthdr0, sizeof (struct ip6_rthdr0));
- int total = in_rthdr0->ip6r0_segleft * 8 / sizeof (struct in6_addr);
+ int total = in_rthdr0->ip6r0_len * 8 / sizeof (struct in6_addr);
for (int i = 0; i < total / 2; ++i)
{
/* Remember, IN_RTHDR0 and OUT_RTHDR0 might overlap. */
--
Summary: fix the total number of ip addrs in Router Header type 0
in inet6_rth_reverse()
Product: glibc
Version: unspecified
Status: NEW
Severity: normal
Priority: P2
Component: libc
AssignedTo: drepper at redhat dot com
ReportedBy: yanghy at cn dot fujitsu dot com
CC: glibc-bugs at sources dot redhat dot com,yanghy at cn
dot fujitsu dot com
http://sourceware.org/bugzilla/show_bug.cgi?id=9880
------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.