diff options
author | Jakub Jelinek <jakub@redhat.com> | 2009-03-20 20:00:20 +0000 |
---|---|---|
committer | Jakub Jelinek <jakub@redhat.com> | 2009-03-20 20:00:20 +0000 |
commit | ef860a878bf532436a469fc1f89fe3366862a949 (patch) | |
tree | c4a2666ac77cdaa00f41bd8f66a828b39e2642ff /inet/inet6_rth.c | |
parent | d4c583b4466962a9d9d4ca54ab6108dc7b42cdcc (diff) |
Updated to fedora-glibc-20090320T1944cvs/fedora-glibc-2_9_90-11
Diffstat (limited to 'inet/inet6_rth.c')
-rw-r--r-- | inet/inet6_rth.c | 9 |
1 files changed, 7 insertions, 2 deletions
diff --git a/inet/inet6_rth.c b/inet/inet6_rth.c index 15f8240909..36269fc6a4 100644 --- a/inet/inet6_rth.c +++ b/inet/inet6_rth.c @@ -1,4 +1,4 @@ -/* Copyright (C) 2006 Free Software Foundation, Inc. +/* Copyright (C) 2006, 2009 Free Software Foundation, Inc. This file is part of the GNU C Library. Contributed by Ulrich Drepper <drepper@redhat.com>, 2006. @@ -93,6 +93,9 @@ inet6_rth_add (void *bp, const struct in6_addr *addr) struct ip6_rthdr0 *rthdr0; case IPV6_RTHDR_TYPE_0: rthdr0 = (struct ip6_rthdr0 *) rthdr; + if (rthdr0->ip6r0_len * 8 / sizeof (struct in6_addr) + - rthdr0->ip6r0_segleft < 1) + return -1; memcpy (&rthdr0->ip6r0_addr[rthdr0->ip6r0_segleft++], addr, sizeof (struct in6_addr)); @@ -127,7 +130,7 @@ inet6_rth_reverse (const void *in, void *out) /* Copy header, not the addresses. The memory regions can overlap. */ memmove (out_rthdr0, in_rthdr0, sizeof (struct ip6_rthdr0)); - int total = in_rthdr0->ip6r0_segleft * 8 / sizeof (struct in6_addr); + int total = in_rthdr0->ip6r0_len * 8 / sizeof (struct in6_addr); for (int i = 0; i < total / 2; ++i) { /* Remember, IN_RTHDR0 and OUT_RTHDR0 might overlap. */ @@ -138,6 +141,8 @@ inet6_rth_reverse (const void *in, void *out) if (total % 2 != 0 && in != out) out_rthdr0->ip6r0_addr[total / 2] = in_rthdr0->ip6r0_addr[total / 2]; + out_rthdr0->ip6r0_segleft = total; + return 0; } |