[PATCH 3/7] tap: Assert IPv6 tail size before subtracting header length

In tap6_handler(), iov_tail_size(&data) - sizeof(*ip6h) is used to compute the expected payload length. The subtraction is safe because IOV_PEEK_HEADER() already verified that the tail contains at least sizeof(*ip6h) bytes, but add an assert to make the invariant explicit. Signed-off-by: Jon Maloy --- tap.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/tap.c b/tap.c index 6d93c7ce..d0d5148e 100644 --- a/tap.c +++ b/tap.c @@ -986,7 +986,9 @@ resume: if (!ip6h) continue; - check = iov_tail_size(&data) - sizeof(*ip6h); + check = iov_tail_size(&data); + assert(check >= sizeof(*ip6h)); + check -= sizeof(*ip6h); saddr = &ip6h->saddr; daddr = &ip6h->daddr; -- 2.52.0