On Wed, Jul 08, 2026 at 06:31:59PM -0400, Jon Maloy wrote:
In tap6_handler(), iov_tail_size(&data) - sizeof(*ip6h) is used to compute the expected payload length. The subtraction is safe because IOV_PEEK_HEADER() already verified that the tail contains at least sizeof(*ip6h) bytes, but add an assert to make the invariant explicit.
Again, I think "assumption" would be clearer. I think of "invariant" as something that applies at every iteration of a loop, or to a data structure at all times, rather than just to a particular variable at a particular point
Signed-off-by: Jon Maloy
Reviewed-by: David Gibson
--- tap.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/tap.c b/tap.c index 6d93c7ce..d0d5148e 100644 --- a/tap.c +++ b/tap.c @@ -986,7 +986,9 @@ resume: if (!ip6h) continue;
- check = iov_tail_size(&data) - sizeof(*ip6h); + check = iov_tail_size(&data); + assert(check >= sizeof(*ip6h)); + check -= sizeof(*ip6h);
saddr = &ip6h->saddr; daddr = &ip6h->daddr; -- 2.52.0
-- David Gibson (he or they) | I'll have my music baroque, and my code david AT gibson.dropbear.id.au | minimalist, thank you, not the other way | around. http://www.ozlabs.org/~dgibson