[BZ #9880]

	* inet/inet6_rth.c (inet6_rth_reverse): Compute number of segments
	correctly.  Set segleft member in output as required.
	Patch partly by Yang Hongyang <yanghy@cn.fujitsu.com>.
	* inet/tst-inet6_rth.c (do_test): Add tests for inet6_rth_reverse.

2 files changed, 155 insertions, 1 deletions

diff --git a/inet/inet6_rth.c b/inet/inet6_rth.c
index e0fad33..36269fc 100644
--- a/inet/inet6_rth.c
+++ b/inet/inet6_rth.c
@@ -130,7 +130,7 @@ inet6_rth_reverse (const void *in, void *out)
       /* Copy header, not the addresses.  The memory regions can overlap.  */
       memmove (out_rthdr0, in_rthdr0, sizeof (struct ip6_rthdr0));
 
-      int total = in_rthdr0->ip6r0_segleft * 8 / sizeof (struct in6_addr);
+      int total = in_rthdr0->ip6r0_len * 8 / sizeof (struct in6_addr);
       for (int i = 0; i < total / 2; ++i)
 	{
 	  /* Remember, IN_RTHDR0 and OUT_RTHDR0 might overlap.  */
@@ -141,6 +141,8 @@ inet6_rth_reverse (const void *in, void *out)
       if (total % 2 != 0 && in != out)
 	out_rthdr0->ip6r0_addr[total / 2] = in_rthdr0->ip6r0_addr[total / 2];
 
+      out_rthdr0->ip6r0_segleft = total;
+
       return 0;
     }
 
diff --git a/inet/tst-inet6_rth.c b/inet/tst-inet6_rth.c
index 454a13f..4c5c90a 100644
--- a/inet/tst-inet6_rth.c
+++ b/inet/tst-inet6_rth.c
@@ -1,4 +1,6 @@
 #include <stdio.h>
+#include <string.h>
+#include <arpa/inet.h>
 #include <netinet/ip6.h>
 
 static int
@@ -29,6 +31,156 @@ do_test (void)
       puts ("second inet6_rth_add failed");
       res = 1;
     }
+
+  for (int nseg = 4; nseg < 6; ++nseg)
+    {
+      printf ("nseg = %d\n", nseg);
+
+      p = inet6_rth_init (buf, sizeof (buf), IPV6_RTHDR_TYPE_0, nseg);
+      if (p == NULL)
+	{
+	  puts ("third inet6_rth_init failed");
+	  res = 1;
+	}
+      else
+	{
+	  struct in6_addr tmp;
+	  memset (&tmp, '\0', sizeof (tmp));
+
+	  for (int i = 0; i < nseg; ++i)
+	    {
+	      tmp.s6_addr[0] = i;
+	      if (inet6_rth_add (p, &tmp) != 0)
+		{
+		  printf ("call %d of third inet6_rth_add failed\n", i + 1);
+		  res = 1;
+		  goto out;
+		}
+	    }
+	  ((struct ip6_rthdr0 *) p)->ip6r0_segleft = 0;
+	  if (inet6_rth_segments (p) != nseg)
+	    {
+	      puts ("\
+inet6_rth_segments returned wrong value after loop with third inet6_rth_add");
+	      res = 1;
+	      goto out;
+	    }
+
+	  char buf2[1000];
+	  if (inet6_rth_reverse (p, buf2) != 0)
+	    {
+	      puts ("first inet6_rth_reverse call failed");
+	      res = 1;
+	      goto out;
+	    }
+	  if (((struct ip6_rthdr0 *) buf2)->ip6r0_segleft != nseg)
+	    {
+	      puts ("segleft after first inet6_rth_reverse wrong");
+	      res = 1;
+	    }
+
+	  if (inet6_rth_segments (p) != inet6_rth_segments (buf2))
+	    {
+	      puts ("number of seconds after first inet6_rth_reverse differs");
+	      res = 1;
+	      goto out;
+	    }
+
+	  for (int i = 0; i < nseg; ++i)
+	    {
+	      struct in6_addr *addr = inet6_rth_getaddr (buf2, i);
+	      if (addr == NULL)
+		{
+		  printf ("call %d of first inet6_rth_getaddr failed\n",
+			  i + 1);
+		  res = 1;
+		}
+	      else if (addr->s6_addr[0] != nseg - 1 - i
+		       || memcmp (&addr->s6_addr[1], &in6addr_any.s6_addr[1],
+				  sizeof (in6addr_any)
+				  - sizeof (in6addr_any.s6_addr[0])) != 0)
+		{
+		  char addrbuf[100];
+		  inet_ntop (AF_INET6, addr, addrbuf, sizeof (addrbuf));
+		  printf ("\
+address %d after first inet6_rth_reverse wrong (%s)\n",
+			  i + 1, addrbuf);
+		  res = 1;
+		}
+	    }
+	out:
+	  ;
+	}
+
+      p = inet6_rth_init (buf, sizeof (buf), IPV6_RTHDR_TYPE_0, nseg);
+      if (p == NULL)
+	{
+	  puts ("fourth inet6_rth_init failed");
+	  res = 1;
+	}
+      else
+	{
+	  struct in6_addr tmp;
+	  memset (&tmp, '\0', sizeof (tmp));
+
+	  for (int i = 0; i < nseg; ++i)
+	    {
+	      tmp.s6_addr[0] = i;
+	      if (inet6_rth_add (p, &tmp) != 0)
+		{
+		  printf ("call %d of fourth inet6_rth_add failed\n", i + 1);
+		  res = 1;
+		  goto out2;
+		}
+	    }
+	  ((struct ip6_rthdr0 *) p)->ip6r0_segleft = 0;
+	  if (inet6_rth_segments (p) != nseg)
+	    {
+	      puts ("\
+inet6_rth_segments returned wrong value after loop with fourth inet6_rth_add");
+	      res = 1;
+	      goto out2;
+	    }
+
+	  if (inet6_rth_reverse (p, p) != 0)
+	    {
+	      puts ("second inet6_rth_reverse call failed");
+	      res = 1;
+	      goto out2;
+	    }
+	  if (((struct ip6_rthdr0 *) p)->ip6r0_segleft != nseg)
+	    {
+	      puts ("segleft after second inet6_rth_reverse wrong");
+	      res = 1;
+	    }
+
+	  for (int i = 0; i < nseg; ++i)
+	    {
+	      struct in6_addr *addr = inet6_rth_getaddr (p, i);
+	      if (addr == NULL)
+		{
+		  printf ("call %d of second inet6_rth_getaddr failed\n",
+			  i + 1);
+		  res = 1;
+		}
+	      else if (addr->s6_addr[0] != nseg - 1 - i
+		       || memcmp (&addr->s6_addr[1], &in6addr_any.s6_addr[1],
+				  sizeof (in6addr_any)
+				  - sizeof (in6addr_any.s6_addr[0])) != 0)
+		{
+		  char addrbuf[100];
+		  inet_ntop (AF_INET6, addr, addrbuf, sizeof (addrbuf));
+		  printf ("\
+address %d after second inet6_rth_reverse wrong (%s)\n",
+			  i + 1, addrbuf);
+		  res = 1;
+		}
+	    }
+	out2:
+	  ;
+	}
+    }
+
   return res;
 }