* Extract the addresses of the passed sockaddrs. * Do a little sanity checking so as to avoid bad memory references. * This data is derived straight from userland. */
| 90 | * This data is derived straight from userland. |
| 91 | */ |
| 92 | static int |
| 93 | rt_xaddrs(caddr_t cp, caddr_t cplim, struct rt_addrinfo *rtinfo) |
| 94 | { |
| 95 | struct sockaddr *sa; |
| 96 | int i; |
| 97 | |
| 98 | for (i = 0; i < RTAX_MAX && cp < cplim; i++) { |
| 99 | if ((rtinfo->rti_addrs & (1 << i)) == 0) |
| 100 | continue; |
| 101 | sa = (struct sockaddr *)cp; |
| 102 | /* |
| 103 | * It won't fit. |
| 104 | */ |
| 105 | if (cp + sa->sa_len > cplim) |
| 106 | return (EINVAL); |
| 107 | /* |
| 108 | * there are no more.. quit now |
| 109 | * If there are more bits, they are in error. |
| 110 | * I've seen this. route(1) can evidently generate these. |
| 111 | * This causes kernel to core dump. |
| 112 | * for compatibility, If we see this, point to a safe address. |
| 113 | */ |
| 114 | if (sa->sa_len == 0) { |
| 115 | rtinfo->rti_info[i] = &sa_zero; |
| 116 | return (0); /* should be EINVAL but for compat */ |
| 117 | } |
| 118 | /* accept it */ |
| 119 | #ifdef INET6 |
| 120 | if (sa->sa_family == AF_INET6) |
| 121 | sa6_embedscope((struct sockaddr_in6 *)sa, |
| 122 | V_ip6_use_defzone); |
| 123 | #endif |
| 124 | rtinfo->rti_info[i] = sa; |
| 125 | cp += SA_SIZE(sa); |
| 126 | } |
| 127 | return (0); |
| 128 | } |
| 129 | |
| 130 | static inline void |
| 131 | fill_sockaddr_inet(struct sockaddr_in *sin, struct in_addr addr) |
no test coverage detected