re_search_internal: Avoid overflow in computing re_malloc buffer size
[glibc.git] / inet / inet6_rth.c
blob36269fc6a487988a161eb81e06cb630037a2ea38
1 /* Copyright (C) 2006, 2009 Free Software Foundation, Inc.
2 This file is part of the GNU C Library.
3 Contributed by Ulrich Drepper <drepper@redhat.com>, 2006.
5 The GNU C Library is free software; you can redistribute it and/or
6 modify it under the terms of the GNU Lesser General Public
7 License as published by the Free Software Foundation; either
8 version 2.1 of the License, or (at your option) any later version.
10 The GNU C Library is distributed in the hope that it will be useful,
11 but WITHOUT ANY WARRANTY; without even the implied warranty of
12 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
13 Lesser General Public License for more details.
15 You should have received a copy of the GNU Lesser General Public
16 License along with the GNU C Library; if not, write to the Free
17 Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA
18 02111-1307 USA. */
20 #include <string.h>
21 #include <netinet/in.h>
22 #include <netinet/ip6.h>
25 /* RFC 3542, 7.1
27 This function returns the number of bytes required to hold a
28 Routing header of the specified type containing the specified
29 number of segments (addresses). For an IPv6 Type 0 Routing header,
30 the number of segments must be between 0 and 127, inclusive. */
31 socklen_t
32 inet6_rth_space (int type, int segments)
34 switch (type)
36 case IPV6_RTHDR_TYPE_0:
37 if (segments < 0 || segments > 127)
38 return 0;
40 return sizeof (struct ip6_rthdr0) + segments * sizeof (struct in6_addr);
43 return 0;
47 /* RFC 3542, 7.2
49 This function initializes the buffer pointed to by BP to contain a
50 Routing header of the specified type and sets ip6r_len based on the
51 segments parameter. */
52 void *
53 inet6_rth_init (void *bp, socklen_t bp_len, int type, int segments)
55 struct ip6_rthdr *rthdr = (struct ip6_rthdr *) bp;
57 switch (type)
59 case IPV6_RTHDR_TYPE_0:
60 /* Make sure the parameters are valid and the buffer is large enough. */
61 if (segments < 0 || segments > 127)
62 break;
64 socklen_t len = (sizeof (struct ip6_rthdr0)
65 + segments * sizeof (struct in6_addr));
66 if (len > bp_len)
67 break;
69 /* Some implementations seem to initialize the whole memory area. */
70 memset (bp, '\0', len);
72 /* Length in units of 8 octets. */
73 rthdr->ip6r_len = segments * sizeof (struct in6_addr) / 8;
74 rthdr->ip6r_type = IPV6_RTHDR_TYPE_0;
75 return bp;
78 return NULL;
82 /* RFC 3542, 7.3
84 This function adds the IPv6 address pointed to by addr to the end of
85 the Routing header being constructed. */
86 int
87 inet6_rth_add (void *bp, const struct in6_addr *addr)
89 struct ip6_rthdr *rthdr = (struct ip6_rthdr *) bp;
91 switch (rthdr->ip6r_type)
93 struct ip6_rthdr0 *rthdr0;
94 case IPV6_RTHDR_TYPE_0:
95 rthdr0 = (struct ip6_rthdr0 *) rthdr;
96 if (rthdr0->ip6r0_len * 8 / sizeof (struct in6_addr)
97 - rthdr0->ip6r0_segleft < 1)
98 return -1;
100 memcpy (&rthdr0->ip6r0_addr[rthdr0->ip6r0_segleft++],
101 addr, sizeof (struct in6_addr));
103 return 0;
106 return -1;
110 /* RFC 3542, 7.4
112 This function takes a Routing header extension header (pointed to by
113 the first argument) and writes a new Routing header that sends
114 datagrams along the reverse of that route. The function reverses the
115 order of the addresses and sets the segleft member in the new Routing
116 header to the number of segments. */
118 inet6_rth_reverse (const void *in, void *out)
120 struct ip6_rthdr *in_rthdr = (struct ip6_rthdr *) in;
122 switch (in_rthdr->ip6r_type)
124 struct ip6_rthdr0 *in_rthdr0;
125 struct ip6_rthdr0 *out_rthdr0;
126 case IPV6_RTHDR_TYPE_0:
127 in_rthdr0 = (struct ip6_rthdr0 *) in;
128 out_rthdr0 = (struct ip6_rthdr0 *) out;
130 /* Copy header, not the addresses. The memory regions can overlap. */
131 memmove (out_rthdr0, in_rthdr0, sizeof (struct ip6_rthdr0));
133 int total = in_rthdr0->ip6r0_len * 8 / sizeof (struct in6_addr);
134 for (int i = 0; i < total / 2; ++i)
136 /* Remember, IN_RTHDR0 and OUT_RTHDR0 might overlap. */
137 struct in6_addr temp = in_rthdr0->ip6r0_addr[i];
138 out_rthdr0->ip6r0_addr[i] = in_rthdr0->ip6r0_addr[total - 1 - i];
139 out_rthdr0->ip6r0_addr[total - 1 - i] = temp;
141 if (total % 2 != 0 && in != out)
142 out_rthdr0->ip6r0_addr[total / 2] = in_rthdr0->ip6r0_addr[total / 2];
144 out_rthdr0->ip6r0_segleft = total;
146 return 0;
149 return -1;
153 /* RFC 3542, 7.5
155 This function returns the number of segments (addresses) contained in
156 the Routing header described by BP. */
158 inet6_rth_segments (const void *bp)
160 struct ip6_rthdr *rthdr = (struct ip6_rthdr *) bp;
162 switch (rthdr->ip6r_type)
164 case IPV6_RTHDR_TYPE_0:
166 return rthdr->ip6r_len * 8 / sizeof (struct in6_addr);
169 return -1;
173 /* RFC 3542, 7.6
175 This function returns a pointer to the IPv6 address specified by
176 index (which must have a value between 0 and one less than the
177 value returned by 'inet6_rth_segments') in the Routing header
178 described by BP. */
179 struct in6_addr *
180 inet6_rth_getaddr (const void *bp, int index)
182 struct ip6_rthdr *rthdr = (struct ip6_rthdr *) bp;
184 switch (rthdr->ip6r_type)
186 struct ip6_rthdr0 *rthdr0;
187 case IPV6_RTHDR_TYPE_0:
188 rthdr0 = (struct ip6_rthdr0 *) rthdr;
190 if (index >= rthdr0->ip6r0_len * 8 / sizeof (struct in6_addr))
191 break;
193 return &rthdr0->ip6r0_addr[index];
196 return NULL;