* Extract the addresses of the passed sockaddrs. * Do a little sanity checking so as to avoid bad memory references. * This data is derived straight from userland. */
| 1258 | * This data is derived straight from userland. |
| 1259 | */ |
| 1260 | static int |
| 1261 | rt_xaddrs(caddr_t cp, caddr_t cplim, struct rt_addrinfo *rtinfo) |
| 1262 | { |
| 1263 | struct sockaddr *sa; |
| 1264 | int i; |
| 1265 | |
| 1266 | for (i = 0; i < RTAX_MAX && cp < cplim; i++) { |
| 1267 | if ((rtinfo->rti_addrs & (1 << i)) == 0) |
| 1268 | continue; |
| 1269 | sa = (struct sockaddr *)cp; |
| 1270 | /* |
| 1271 | * It won't fit. |
| 1272 | */ |
| 1273 | if (cp + sa->sa_len > cplim) |
| 1274 | return (EINVAL); |
| 1275 | /* |
| 1276 | * there are no more.. quit now |
| 1277 | * If there are more bits, they are in error. |
| 1278 | * I've seen this. route(1) can evidently generate these. |
| 1279 | * This causes kernel to core dump. |
| 1280 | * for compatibility, If we see this, point to a safe address. |
| 1281 | */ |
| 1282 | if (sa->sa_len == 0) { |
| 1283 | rtinfo->rti_info[i] = &sa_zero; |
| 1284 | return (0); /* should be EINVAL but for compat */ |
| 1285 | } |
| 1286 | /* accept it */ |
| 1287 | #ifdef INET6 |
| 1288 | if (sa->sa_family == AF_INET6) |
| 1289 | sa6_embedscope((struct sockaddr_in6 *)sa, |
| 1290 | V_ip6_use_defzone); |
| 1291 | #endif |
| 1292 | rtinfo->rti_info[i] = sa; |
| 1293 | cp += SA_SIZE(sa); |
| 1294 | } |
| 1295 | return (0); |
| 1296 | } |
| 1297 | |
| 1298 | #ifdef INET |
| 1299 | static inline void |
no test coverage detected