netinet/libalias/alias_sctp.c

210 #define SN_SCTP_NEXTCHUNK(chunkhead)	(struct sctp_chunkhdr *)(((char *)chunkhead) + SCTP_SIZE32(ntohs(chunkhead->chunk_length)))
939 		chunk_hdr->chunk_length = htons(sizeof(*chunk_hdr) + sizeof(struct sctp_error_cause));
941 		chunk_hdr->chunk_length = htons(sizeof(*chunk_hdr));
1026 	int chunk_length;
1065 	chunk_length = SCTP_SIZE32(ntohs(chunk_hdr->chunk_length));
1066 	if ((chunk_length < SN_MIN_CHUNK_SIZE) || (chunk_length > bytes_left)) /* malformed chunk - could cause endless loop*/
1088 	sm->chunk_length = 0; /* only care about length for key chunks */
1092 			if (chunk_length < sizeof(struct sctp_init_chunk)) /* malformed chunk*/
1096 			sm->chunk_length = chunk_length;
1114 			if (chunk_length < sizeof(struct sctp_init_ack_chunk)) /* malformed chunk*/
1118 			sm->chunk_length = chunk_length;
1122 			sm->chunk_length = chunk_length;
1125 			if (chunk_length < sizeof(struct sctp_shutdown_ack_chunk)) /* malformed chunk*/
1129 				sm->chunk_length = chunk_length;
1135 				sm->chunk_length = chunk_length;
1140 				if (chunk_length < (sizeof(struct  sctp_asconf_chunk) + sizeof(struct  sctp_ipv4addr_param))) /* malformed chunk*/
1152 					sm->chunk_length = chunk_length - sizeof(struct  sctp_asconf_chunk) - sizeof(struct  sctp_ipv4addr_param); /* rest of chunk */
1154 					if (chunk_length < (sizeof(struct  sctp_asconf_chunk) + sizeof(struct  sctp_ipv6addr_param))) /* malformed chunk*/
1158 					sm->chunk_length = chunk_length - sizeof(struct  sctp_asconf_chunk) - sizeof(struct  sctp_ipv6addr_param); /* rest of chunk */
1178 				if (chunk_length < sizeof(struct  sctp_asconf_ack_chunk)) /* malformed chunk*/
1185 				sm->chunk_length = chunk_length - sizeof(struct sctp_asconf_ack_chunk);
1197 		bytes_left-= chunk_length;
1210 		chunk_length = SCTP_SIZE32(ntohs(chunk_hdr->chunk_length));
1211 		if ((chunk_length < SN_MIN_CHUNK_SIZE) || (chunk_length > bytes_left))
1260 	bytes_left = sm->chunk_length;
1328 			bytes_left = sm->chunk_length - sizeof(struct sctp_init_chunk);
1332 			bytes_left = sm->chunk_length - sizeof(struct sctp_init_ack_chunk);
1336 			bytes_left = sm->chunk_length;
1484 	bytes_left = sm->chunk_length;
1588 	bytes_left = sm->chunk_length;
1639 	bytes_left = sm->chunk_length;