re_search_internal: Avoid overflow in computing re_malloc buffer size
[glibc.git] / inet / inet6_opt.c
blobccf7af5f61b275391a319e2604b8cce426be1f62
1 /* Copyright (C) 2006, 2007, 2008 Free Software Foundation, Inc.
2 This file is part of the GNU C Library.
3 Contributed by Ulrich Drepper <drepper@redhat.com>, 2006.
5 The GNU C Library is free software; you can redistribute it and/or
6 modify it under the terms of the GNU Lesser General Public
7 License as published by the Free Software Foundation; either
8 version 2.1 of the License, or (at your option) any later version.
10 The GNU C Library is distributed in the hope that it will be useful,
11 but WITHOUT ANY WARRANTY; without even the implied warranty of
12 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
13 Lesser General Public License for more details.
15 You should have received a copy of the GNU Lesser General Public
16 License along with the GNU C Library; if not, write to the Free
17 Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA
18 02111-1307 USA. */
20 #include <string.h>
21 #include <netinet/in.h>
22 #include <netinet/ip6.h>
25 /* RFC 3542, 10.1
27 This function returns the number of bytes needed for the empty
28 extension header i.e., without any options. If EXTBUF is not NULL it
29 also initializes the extension header to have the correct length
30 field. In that case if the EXTLEN value is not a positive (i.e.,
31 non-zero) multiple of 8 the function fails and returns -1. */
32 int
33 inet6_opt_init (void *extbuf, socklen_t extlen)
35 if (extbuf != NULL)
37 if (extlen <= 0 || (extlen % 8) != 0 || extlen > 256 * 8)
38 return -1;
40 /* Fill in the length in units of 8 octets. */
41 struct ip6_hbh *extp = (struct ip6_hbh *) extbuf;
43 /* RFC 2460 requires that the header extension length is the
44 length of the option header in 8-byte units, not including
45 the first 8 bytes. Hence we have to subtract one. */
46 extp->ip6h_len = extlen / 8 - 1;
49 return sizeof (struct ip6_hbh);
53 static void
54 add_padding (uint8_t *extbuf, int offset, int npad)
56 if (npad == 1)
57 extbuf[offset] = IP6OPT_PAD1;
58 else if (npad > 0)
60 struct ip6_opt *pad_opt = (struct ip6_opt *) (extbuf + offset);
62 pad_opt->ip6o_type = IP6OPT_PADN;
63 pad_opt->ip6o_len = npad - sizeof (struct ip6_opt);
64 /* Clear the memory used by the padding. */
65 memset (pad_opt + 1, '\0', pad_opt->ip6o_len);
71 /* RFC 3542, 10.2
73 This function returns the updated total length taking into account
74 adding an option with length 'len' and alignment 'align'. If
75 EXTBUF is not NULL then, in addition to returning the length, the
76 function inserts any needed pad option, initializes the option
77 (setting the type and length fields) and returns a pointer to the
78 location for the option content in databufp. If the option does
79 not fit in the extension header buffer the function returns -1. */
80 int
81 inet6_opt_append (void *extbuf, socklen_t extlen, int offset, uint8_t type,
82 socklen_t len, uint8_t align, void **databufp)
84 /* Check minimum offset. */
85 if (offset < sizeof (struct ip6_hbh))
86 return -1;
88 /* One cannot add padding options. */
89 if (type == IP6OPT_PAD1 || type == IP6OPT_PADN)
90 return -1;
92 /* The option length must fit in one octet. */
93 if (len > 255)
94 return -1;
96 /* The alignment can only by 1, 2, 4, or 8 and must not exceed the
97 option length. */
98 if (align == 0 || align > 8 || (align & (align - 1)) != 0 || align > len)
99 return -1;
101 /* Determine the needed padding for alignment. Following the
102 current content of the buffer we have the is the IPv6 option type
103 and length, followed immediately by the data. The data has the
104 alignment constraints. Therefore padding must be inserted in the
105 form of padding options before the new option. */
106 int data_offset = offset + sizeof (struct ip6_opt);
107 int npad = (align - data_offset % align) & (align - 1);
109 if (extbuf != NULL)
111 /* Now we can check whether the buffer is large enough. */
112 if (data_offset + npad + len > extlen)
113 return -1;
115 add_padding (extbuf, offset, npad);
117 offset += npad;
119 /* Now prepare the option itself. */
120 struct ip6_opt *opt = (struct ip6_opt *) ((uint8_t *) extbuf + offset);
122 opt->ip6o_type = type;
123 opt->ip6o_len = len;
125 *databufp = opt + 1;
127 else
128 offset += npad;
130 return offset + sizeof (struct ip6_opt) + len;
134 /* RFC 3542, 10.3
136 This function returns the updated total length taking into account
137 the final padding of the extension header to make it a multiple of
138 8 bytes. If EXTBUF is not NULL the function also initializes the
139 option by inserting a Pad1 or PadN option of the proper length. */
141 inet6_opt_finish (void *extbuf, socklen_t extlen, int offset)
143 /* Check minimum offset. */
144 if (offset < sizeof (struct ip6_hbh))
145 return -1;
147 /* Required padding at the end. */
148 int npad = (8 - (offset & 7)) & 7;
150 if (extbuf != NULL)
152 /* Make sure the buffer is large enough. */
153 if (offset + npad > extlen)
154 return -1;
156 add_padding (extbuf, offset, npad);
159 return offset + npad;
163 /* RFC 3542, 10.4
165 This function inserts data items of various sizes in the data
166 portion of the option. VAL should point to the data to be
167 inserted. OFFSET specifies where in the data portion of the option
168 the value should be inserted; the first byte after the option type
169 and length is accessed by specifying an offset of zero. */
171 inet6_opt_set_val (void *databuf, int offset, void *val, socklen_t vallen)
173 memcpy ((uint8_t *) databuf + offset, val, vallen);
175 return offset + vallen;
179 /* RFC 3542, 10.5
181 This function parses received option extension headers returning
182 the next option. EXTBUF and EXTLEN specifies the extension header.
183 OFFSET should either be zero (for the first option) or the length
184 returned by a previous call to 'inet6_opt_next' or
185 'inet6_opt_find'. It specifies the position where to continue
186 scanning the extension buffer. */
188 inet6_opt_next (void *extbuf, socklen_t extlen, int offset, uint8_t *typep,
189 socklen_t *lenp, void **databufp)
191 if (offset == 0)
192 offset = sizeof (struct ip6_hbh);
193 else if (offset < sizeof (struct ip6_hbh))
194 return -1;
196 while (offset < extlen)
198 struct ip6_opt *opt = (struct ip6_opt *) ((uint8_t *) extbuf + offset);
200 if (opt->ip6o_type == IP6OPT_PAD1)
201 /* Single byte padding. */
202 ++offset;
203 else if (opt->ip6o_type == IP6OPT_PADN)
204 offset += sizeof (struct ip6_opt) + opt->ip6o_len;
205 else
207 /* Check whether the option is valid. */
208 offset += sizeof (struct ip6_opt) + opt->ip6o_len;
209 if (offset > extlen)
210 return -1;
212 *typep = opt->ip6o_type;
213 *lenp = opt->ip6o_len;
214 *databufp = opt + 1;
215 return offset;
219 return -1;
223 /* RFC 3542, 10.6
225 This function is similar to the previously described
226 'inet6_opt_next' function, except this function lets the caller
227 specify the option type to be searched for, instead of always
228 returning the next option in the extension header. */
230 inet6_opt_find (void *extbuf, socklen_t extlen, int offset, uint8_t type,
231 socklen_t *lenp, void **databufp)
233 if (offset == 0)
234 offset = sizeof (struct ip6_hbh);
235 else if (offset < sizeof (struct ip6_hbh))
236 return -1;
238 while (offset < extlen)
240 struct ip6_opt *opt = (struct ip6_opt *) ((uint8_t *) extbuf + offset);
242 if (opt->ip6o_type == IP6OPT_PAD1)
244 /* Single byte padding. */
245 ++offset;
246 if (type == IP6OPT_PAD1)
248 *lenp = 0;
249 *databufp = (uint8_t *) extbuf + offset;
250 return offset;
253 else if (opt->ip6o_type != type)
254 offset += sizeof (struct ip6_opt) + opt->ip6o_len;
255 else
257 /* Check whether the option is valid. */
258 offset += sizeof (struct ip6_opt) + opt->ip6o_len;
259 if (offset > extlen)
260 return -1;
262 *lenp = opt->ip6o_len;
263 *databufp = opt + 1;
264 return offset;
268 return -1;
272 /* RFC 3542, 10.7
274 This function extracts data items of various sizes in the data
275 portion of the option. */
277 inet6_opt_get_val (void *databuf, int offset, void *val, socklen_t vallen)
279 memcpy (val, (uint8_t *) databuf + offset, vallen);
281 return offset + vallen;