IPfilter
[Top] [All Lists]

Re: Alignment bug in IPv6 ICMP handling

To: ipfilter@coombs.anu.edu.au
Subject: Re: Alignment bug in IPv6 ICMP handling
From: Hans Werner Strube <strube@physik3.gwdg.de>
Date: Wed, 6 Jun 2007 09:40:18 +0200 (MET DST)
Delivered-to: sp-com-lists@consult.net
Delivered-to: ipfilter-list@securepoint.com
Sender: owner-ipfilter@coombs.anu.edu.au
Geoff Adams wrote:
> struct ip6_hdr {
>          union {
>                  struct ip6_hdrctl {
>                          u_int32_t ip6_un1_flow; /* 20 bits of flow- 
> ID */
>                          u_int16_t ip6_un1_plen; /* payload length */
>                          u_int8_t  ip6_un1_nxt;  /* next header */
>                          u_int8_t  ip6_un1_hlim; /* hop limit */
>                  } ip6_un1;
>                  u_int8_t ip6_un2_vfc;   /* 4 bits version, top 4  
> bits class */
>          } ip6_ctlun;
>          struct in6_addr ip6_src;        /* source address */
>          struct in6_addr ip6_dst;        /* destination address */
> } __attribute__((__packed__));
> 
> Sure enough, that 8-bit ip6_un2_vfc un-aligns ip6_src.

Hardly. ip6_ctlun is a union, not a struct. ip6_un2_vfc is just made
equivalent to the first 8 bits of ip6_un1, which has size 64 bits, which is
thus also the size of union ip6_ctlun. This kind of union appears to depend
on the byte order, but neither ip6_un1_flow nor ip6_un2_vfc seem to be used
anywhere in the ipfilter sources.

<Prev in Thread] Current Thread [Next in Thread>