netpfil/ipfw/ip_fw_sockopt.c

2294 	ipfw_obj_ctlv *ctlv;
2299 	ctlv = (ipfw_obj_ctlv *)ipfw_get_sopt_space(sd, sizeof(*ctlv));
2300 	if (ctlv == NULL)
2302 	ctlv->head.type = IPFW_TLV_TBLNAME_LIST;
2303 	ctlv->head.length = da->tcount * sizeof(ipfw_obj_ntlv) +
2304 	    sizeof(*ctlv);
2305 	ctlv->count = da->tcount;
2306 	ctlv->objsize = sizeof(ipfw_obj_ntlv);
2326 	ipfw_obj_ctlv *ctlv;
2332 	ctlv = (ipfw_obj_ctlv *)ipfw_get_sopt_space(sd, sizeof(*ctlv));
2333 	if (ctlv == NULL)
2335 	ctlv->head.type = IPFW_TLV_RULE_LIST;
2336 	ctlv->head.length = da->rsize + sizeof(*ctlv);
2337 	ctlv->count = da->rcount;
2872 	if (ci->ctlv != NULL) {
2873 		ti.tlvs = (void *)(ci->ctlv + 1);
2874 		ti.tlen = ci->ctlv->head.length - sizeof(ipfw_obj_ctlv);
2930 	ipfw_obj_ctlv *ctlv, *rtlv, *tstate;
2939 	ctlv = (ipfw_obj_ctlv *)(op3 + 1);
2947 	if (read + sizeof(*ctlv) > sd->valsize)
2950 	if (ctlv->head.type == IPFW_TLV_TBLNAME_LIST) {
2951 		clen = ctlv->head.length;
2953 		if (clen > sd->valsize || clen < sizeof(*ctlv))
2962 		count = (ctlv->head.length - sizeof(*ctlv)) / sizeof(*ntlv);
2963 		if (ctlv->count != count || ctlv->objsize != sizeof(*ntlv))
2972 		ntlv = (ipfw_obj_ntlv *)(ctlv + 1);
2989 		tstate = ctlv;
2990 		read += ctlv->head.length;
2991 		ctlv = (ipfw_obj_ctlv *)((caddr_t)ctlv + ctlv->head.length);
2994 	if (read + sizeof(*ctlv) > sd->valsize)
2997 	if (ctlv->head.type == IPFW_TLV_RULE_LIST) {
2998 		clen = ctlv->head.length;
2999 		if (clen + read > sd->valsize || clen < sizeof(*ctlv))
3007 		if (ctlv->count != 1)
3010 		clen -= sizeof(*ctlv);
3012 		if (ctlv->count > clen / sizeof(struct ip_fw_rule))
3016 		if (ctlv->count == 1) {
3020 			cbuf = malloc(ctlv->count * sizeof(*ci), M_TEMP,
3030 		r = (struct ip_fw_rule *)(ctlv + 1);
3035 			if (rsize > clen || ctlv->count <= count) {
3040 			ci->ctlv = tstate;
3062 		if (ctlv->count != count || error != 0) {
3068 		rtlv = ctlv;
3069 		read += ctlv->head.length;
3070 		ctlv = (ipfw_obj_ctlv *)((caddr_t)ctlv + ctlv->head.length);