| > +/** | > + * dccp_insert_fn_opt - Insert single Feature-Negotiation option into @skb | > + * @type: %DCCPO_CHANGE_L, %DCCPO_CHANGE_R, %DCCPO_CONFIRM_L, %DCCPO_CONFIRM_R | > + * @feat: one out of %dccp_feature_numbers | > + * @val: NN value or SP array (preferred element first) to copy | > + * @len: true length of @val in bytes (excluding first element repetition) | > + * @repeat_first: whether to copy the first element of @val twice | > + * The last argument is used to construct Confirm options, where the preferred | > + * value and the preference list appear separately (RFC 4340, 6.3.1). Preference | > + * lists are kept such that the preferred entry is always first, so we only need | > + * to copy twice, and avoid the overhead of cloning into a bigger array. | > + */ | > +int dccp_insert_fn_opt(struct sk_buff *skb, u8 type, u8 feat, | > + u8 *val, u8 len, bool repeat_first) | > { | > - u8 *to; | > + u8 tot_len, *to; | > | > - if (DCCP_SKB_CB(skb)->dccpd_opt_len + len + 3 > DCCP_MAX_OPT_LEN) { | > - DCCP_WARN("packet too small for feature %d option!\n", feat); | > + /* take the `Feature' field and possible repetition into account */ | > + if (len > (DCCP_SINGLE_OPT_MAXLEN - 2)) { | > + DCCP_WARN("length %u for feature %u too large\n", len, feat); | > return -1; | > } | > | | Here, should check (len > DCCP_SINGLE_OPT_MAXLEN - 3 - repeat_first)? | | if len == DCCP_SINGLE_OPT_MAXLEN - 2, then | | tot_len = 3 + repeat_first + len == (DCCP_SINGLE_OPT_MAXLEN + 1 + | repeat_first) | | The total length of this option will larger than DCCP_SINGLE_OPT_MAXLEN. | in linux/dccp.h /* maximum size of a single TLV-encoded option (sans type/len bytes) */ #define DCCP_SINGLE_OPT_MAXLEN 253 So if we assume that len = DCCP_SINGLE_OPT_MAXLEN - 2 = 251, then tot_len = 3 + 251 + repeat_first, which is * 254 if repeat_first = 0 * 255 if repeat_first = 1 So it is correct. But your input is useful, since it relates to another question, one line below in linux/dccp.h: #define DCCP_CCID_LIST_MAX_LEN (DCCP_SINGLE_OPT_MAXLEN - 2) this value is the same as in the above test, so will revise to use something like #define DCCP_FEAT_MAX_SP_VALS (DCCP_SINGLE_OPT_MAXLEN - 2) to limit the maximum number of server-priority values, in feat.h. Thanks, Gerrit -- To unsubscribe from this list: send the line "unsubscribe dccp" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html