2009-03-15  Ulrich Drepper  <drepper@redhat.com>

	[BZ #9881]
	* inet/inet6_rth.c (inet6_rth_add): Add some error checking.
	Patch mostly by Yang Hongyang <yanghy@cn.fujitsu.com>.
	* inet/Makefile (tests): Add tst-inet6_rth.
	* inet/tst-inet6_rth.c: New file.

--- libc/inet/Makefile	9 Dec 2008 22:47:10 -0000	1.65
+++ libc/inet/Makefile	15 Mar 2009 19:15:50 -0000	1.66
@@ -53,7 +53,7 @@ aux := check_pf check_native ifreq
 
 tests := htontest test_ifindex tst-ntoa tst-ether_aton tst-network \
 	 tst-gethnm test-ifaddrs bug-if1 test-inet6_opt tst-ether_line \
-	 tst-getni1 tst-getni2
+	 tst-getni1 tst-getni2 tst-inet6_rth
 
 include ../Rules
 
--- libc/inet/inet6_rth.c	25 May 2006 04:38:02 -0000	1.1
+++ libc/inet/inet6_rth.c	15 Mar 2009 19:39:21 -0000	1.3
@@ -93,6 +93,9 @@ inet6_rth_add (void *bp, const struct in
       struct ip6_rthdr0 *rthdr0;
     case IPV6_RTHDR_TYPE_0:
       rthdr0 = (struct ip6_rthdr0 *) rthdr;
+      if (rthdr0->ip6r0_len * 8 / sizeof (struct in6_addr)
+	  - rthdr0->ip6r0_segleft < 1)
+        return -1;
 
       memcpy (&rthdr0->ip6r0_addr[rthdr0->ip6r0_segleft++],
 	      addr, sizeof (struct in6_addr));
--- libc/inet/tst-inet6_rth.c	1 Jan 1970 00:00:00 -0000
+++ libc/inet/tst-inet6_rth.c	15 Mar 2009 19:15:37 -0000	1.1
@@ -0,0 +1,36 @@
+#include <stdio.h>
+#include <netinet/ip6.h>
+
+static int
+do_test (void)
+{
+  int res = 0;
+  char buf[1000];
+  void *p = inet6_rth_init (buf, 24, IPV6_RTHDR_TYPE_0, 0);
+  if (p == NULL)
+    {
+      puts ("first inet6_rth_init failed");
+      res = 1;
+    }
+  else if (inet6_rth_add (p, &in6addr_any) == 0)
+    {
+      puts ("first inet6_rth_add succeeded");
+      res = 1;
+    }
+
+  p = inet6_rth_init (buf, 24, IPV6_RTHDR_TYPE_0, 1);
+  if (p == NULL)
+    {
+      puts ("second inet6_rth_init failed");
+      res = 1;
+    }
+  else if (inet6_rth_add (p, &in6addr_any) != 0)
+    {
+      puts ("second inet6_rth_add failed");
+      res = 1;
+    }
+  return res;
+}
+
+#define TEST_FUNCTION do_test ()
+#include "../test-skeleton.c"