Subject: rapi bug?

From: Gustavo Carneiro <[email-masked]>
Date: 26 Oct 2001 18:00:43 +0100

I'm getting segmentation fault in a rsvp receiver application at the
exact moment a PATH message arrives.  The problem seems to be this
function, which processes the adspec object.

int
ntoh_rapi_adspec(IS_adsbody_t *adsp)
	{
	IS_main_hdr_t	*mhp = (IS_main_hdr_t *) adsp;
	IS_serv_hdr_t	*shp = (IS_serv_hdr_t *) (mhp+1);
	IS_serv_hdr_t	*lastshp = NULL;
	IS_parm_hdr_t	*php = NULL, *lastphp = NULL;
	
	NTOH_IS_Main_Hdr(mhp);
	lastshp = (IS_serv_hdr_t *) Next_Main_Hdr(mhp);

  Observe the following gdb output:

329		IS_serv_hdr_t	*shp = (IS_serv_hdr_t *) (mhp+1);
(gdb) p mhp
$2 = (IS_main_hdr_t *) 0x4018afb0
(gdb) p *mhp
$3 = {ismh_version = 0 '\000', ismh_unused = 0 '\000', ismh_len32b = 19}
(gdb) n
330		IS_serv_hdr_t	*lastshp = NULL;
(gdb) n
331		IS_parm_hdr_t	*php = NULL, *lastphp = NULL;
(gdb) n
333		NTOH_IS_Main_Hdr(mhp);
(gdb) n
334		lastshp = (IS_serv_hdr_t *) Next_Main_Hdr(mhp);
(gdb) p *mhp
$4 = {ismh_version = 0 '\000', ismh_unused = 0 '\000', ismh_len32b =
4864}
(gdb) p 19*256
$5 = 4864

  You can see that mhp->ismh_len32b is 19 before calling
NTOH_IS_Main_Hdr(mhp), and becomes 4864 after, i.e. a network-to-host
conversion  is performed.  What bothers me is that 19 seems like a
reasonable value 19*4=76 bytes, but 4864 does not (a 19456 bytes long
object?!).
  I can only conclude that the network-to-host conversion is screwing
things up.  Can anyone confirm this?  Thanks in advance.
  BTW, I'm using isi rsvpd-4.2.4a-1. 

-- 
Gustavo João Alves Marques Carneiro
<[email-masked]> <[email-masked]>