[PATCH v2 3/6] tap: Guard IPv6 tail size subtraction against underflow

[Jon Maloy <jmaloy@redhat.com>]

In tap6_handler(), iov_tail_size(&data) - sizeof(*ip6h) computes
the expected payload length. IOV_PEEK_HEADER() guarantees at least
sizeof(*ip6h) bytes, but add an explicit check to guard the unsigned
subtraction. A too-small tail would indicate a malformed packet, so
skip it.

Signed-off-by: Jon Maloy <jmaloy@redhat.com>

---
v2: Use if-guard instead of assert(), to avoid runtime cost in
    per-packet path and to let the static checker follow the logic.
---
 tap.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/tap.c b/tap.c
index 6d93c7ce..6fd5f595 100644
--- a/tap.c
+++ b/tap.c
@@ -986,7 +986,10 @@ resume:
 		if (!ip6h)
 			continue;
 
-		check = iov_tail_size(&data) - sizeof(*ip6h);
+		check = iov_tail_size(&data);
+		if (check < sizeof(*ip6h))
+			continue;
+		check -= sizeof(*ip6h);
 
 		saddr = &ip6h->saddr;
 		daddr = &ip6h->daddr;
-- 
2.52.0