From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <glibc-bugs-return-9301-listarch-glibc-bugs=sources.redhat.com@sourceware.org>
Received: (qmail 15920 invoked by alias); 23 Feb 2009 07:35:43 -0000
Received: (qmail 15887 invoked by uid 48); 23 Feb 2009 07:35:29 -0000
Date: Mon, 23 Feb 2009 07:35:00 -0000
From: "yanghy at cn dot fujitsu dot com" <sourceware-bugzilla@sourceware.org>
To: glibc-bugs@sources.redhat.com
Message-ID: <20090223073528.9880.yanghy@cn.fujitsu.com>
Reply-To: sourceware-bugzilla@sourceware.org
Subject: [Bug libc/9880] New: fix the total number of ip addrs in Router Header type 0 in inet6_rth_reverse()
X-Bugzilla-Reason: CC
Mailing-List: contact glibc-bugs-help@sourceware.org; run by ezmlm
Precedence: bulk
List-Id: <glibc-bugs.sourceware.org>
List-Subscribe: <mailto:glibc-bugs-subscribe@sourceware.org>
List-Post: <mailto:glibc-bugs@sourceware.org>
List-Help: <mailto:glibc-bugs-help@sourceware.org>, <http://sourceware.org/lists.html#faqs>
Sender: glibc-bugs-owner@sourceware.org
X-SW-Source: 2009-02/txt/msg00082.txt.bz2

The inet6_rth_reverse() is used to reverse the order of the addresses
in the new Routing header, but the total number of ip addrs is miscalculated.

The initial value of segment left is equal to the value of
"ip6r0_len * 8 / sizeof (struct in6_addr)", and the segment left
will decrease to zero until the packet reach the destination.

So, the total ip addrs is equal to "ip6r0_len * 8 / sizeof (struct in6_addr)",
not "ip6r0_segleft * 8 / sizeof (struct in6_addr)" or "ip6r0_segleft".

Signed-off-by: Yang Hongyang <yanghy@cn.fujitsu.com>


--- glibc-2.5-20061008T1257.org/inet/inet6_rth.c	2009-01-11 22:51:33.000000000 +0800
+++ glibc-2.5-20061008T1257/inet/inet6_rth.c	2009-01-11 23:15:23.000000000 +0800
@@ -127,7 +127,7 @@ inet6_rth_reverse (const void *in, void 
       /* Copy header, not the addresses.  The memory regions can overlap.  */
       memmove (out_rthdr0, in_rthdr0, sizeof (struct ip6_rthdr0));
 
-      int total = in_rthdr0->ip6r0_segleft * 8 / sizeof (struct in6_addr);
+      int total = in_rthdr0->ip6r0_len * 8 / sizeof (struct in6_addr);
       for (int i = 0; i < total / 2; ++i)
 	{
 	  /* Remember, IN_RTHDR0 and OUT_RTHDR0 might overlap.  */

-- 
           Summary: fix the total number of ip addrs in Router Header type 0
                    in inet6_rth_reverse()
           Product: glibc
           Version: unspecified
            Status: NEW
          Severity: normal
          Priority: P2
         Component: libc
        AssignedTo: drepper at redhat dot com
        ReportedBy: yanghy at cn dot fujitsu dot com
                CC: glibc-bugs at sources dot redhat dot com,yanghy at cn
                    dot fujitsu dot com


http://sourceware.org/bugzilla/show_bug.cgi?id=9880

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.