-/* Copyright (C) 2006 Free Software Foundation, Inc.
+/* Copyright (C) 2006-2019 Free Software Foundation, Inc.
This file is part of the GNU C Library.
Contributed by Ulrich Drepper <drepper@redhat.com>, 2006.
Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public
- License along with the GNU C Library; if not, write to the Free
- Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA
- 02111-1307 USA. */
+ License along with the GNU C Library; if not, see
+ <https://www.gnu.org/licenses/>. */
#include <string.h>
#include <netinet/in.h>
struct ip6_rthdr0 *rthdr0;
case IPV6_RTHDR_TYPE_0:
rthdr0 = (struct ip6_rthdr0 *) rthdr;
+ if (rthdr0->ip6r0_len * 8 / sizeof (struct in6_addr)
+ - rthdr0->ip6r0_segleft < 1)
+ return -1;
memcpy (&rthdr0->ip6r0_addr[rthdr0->ip6r0_segleft++],
addr, sizeof (struct in6_addr));
/* Copy header, not the addresses. The memory regions can overlap. */
memmove (out_rthdr0, in_rthdr0, sizeof (struct ip6_rthdr0));
- int total = in_rthdr0->ip6r0_segleft * 8 / sizeof (struct in6_addr);
+ int total = in_rthdr0->ip6r0_len * 8 / sizeof (struct in6_addr);
for (int i = 0; i < total / 2; ++i)
{
/* Remember, IN_RTHDR0 and OUT_RTHDR0 might overlap. */
if (total % 2 != 0 && in != out)
out_rthdr0->ip6r0_addr[total / 2] = in_rthdr0->ip6r0_addr[total / 2];
+ out_rthdr0->ip6r0_segleft = total;
+
return 0;
}