This is sources Bugzilla
Bugzilla Version 2.17.5
Bugzilla Bug 5760
  inet6_opt_init does not initialize the extension header length correctly Last modified: 2008-03-08 19:17:29
     Query page      Enter new bug
Bug#: 5760   Hardware:   Reporter: Roland Bless <roland@bless.de>
Host: Target: Build:
Product:     Add CC:
Component:   Version:   CC:
Remove selected CCs
Status: RESOLVED   Priority:  
Resolution: FIXED   Severity:  
Assigned To: Ulrich Drepper <drepper@redhat.com>   Target Milestone:  
Flags: Requestee:
  backport ()
  examined ()
  testsuite ()
Summary:
Keywords:

Attachment Description Type Created Actions
patch_inet6_optinit Proposed fix for the bug. patch 2008-02-12 23:42 Edit | Diff
Create a New Attachment (proposed patch, testcase, etc.) View All

Bug 5760 depends on: Show dependency tree
Show dependency graph
Bug 5760 blocks:

Additional Comments:


Leave as RESOLVED FIXED
Reopen bug
Mark bug as VERIFIED

View Bug Activity   |   Format For Printing


Description:   Last confirmed: 0000-00-00 00:00 Opened: 2008-02-12 23:39
In file inet/inet6_opt.c:
inet6_opt_init (void *extbuf, socklen_t extlen)

What the method should do is written in RFC 3542. 
I tried to set up a hop-by-hop options header
but got errors back from sendmsg(). My findings are
as follows:
RFC 2460 says for HbH Opts and Dest Opts:
Hdr Ext Len          8-bit unsigned integer.  Length of the Hop-by
                     Hop Options header in 8-octet units, not
                     including the first 8 octets.

The problem is now that inet6_opt_init(extbuf, extlen)
with extlen == 8 results in a wrong setting of the
extension header length, because the glibc code sets
extp->ip6h_len = extlen / 8;
which yields 1, but it should be actually 0!
Passing an extlen of 0 is not allowed by the sanity
checks of the method and the RFC requires a _positive_ 
multiple of 8. So constructing a valid IPv6 HbH Opt Extension
header is not possible using the current implementation
of inet6_opt_init().

Fix: extp->ip6h_len = extlen / 8 - 1;

------- Additional Comment #1 From Roland Bless 2008-02-12 23:42 -------
Created an attachment (id=2255)
Proposed fix for the bug.

Fixing the bug is easy

------- Additional Comment #2 From Ulrich Drepper 2008-03-08 19:17 -------
Applied to the trunk.

     Query page      Enter new bug
Actions: New | Query | bug # | Reports | Requests   New Account | Log In