On Nov 27, 2007, at 12:15 PM, Markus Mayer wrote:

> The "work around" code snippet should of course look like this, not  
> like previously posted:
>
> 	case IP_HDRINCL:
> 		if (*m == 0 || (*m)->m_len < sizeof (int))
> 			error = EINVAL;
> 		else {
> 			if (m->m_len == sizeof(int) &&
> 			    *mtod(*m, int *))
> 				inp->inp_flags |= INP_HDRINCL;
> 			else if (m->m_len == sizeof(long) &&
> 			    *mtod(*m, long *))
> 				inp->inp_flags |= INP_HDRINCL;
> 			else
> 				inp->inp_flags &= ~INP_HDRINCL;
> 		}

How about changing m_len < sizeof(int) to != ?

There are lots of places that expect int.  If you are on a BE 64-bit
platform, you can screw up.  I'd rather see us return an error than
to allow broken code to work.