sys/netinet/sctp_input.c

2113 	 * NOTE: We can't use the INIT_ACK's chk_length to determine the
2114 	 * "initack_limit" value.  This is because the chk_length field
4517 	uint32_t chk_length;
4759 		chk_length = ntohs(ch->chunk_length);
4761 		    ch->chunk_type, chk_length);
4762 		SCTP_LTRACE_CHK(inp, stcb, ch->chunk_type, chk_length);
4763 		if (chk_length < sizeof(*ch) ||
4764 		    (*offset + (int)chk_length) > length) {
4791 			if (chk_length > sizeof(chunk_buf)) {
4815 				    chk_length, chunk_buf);
4857 			    (length - *offset > (int)SCTP_SIZE32(chk_length))) {
4866 			if (chk_length > SCTP_LARGEST_INIT_ACCEPTED) {
4920 			    (length - *offset > (int)SCTP_SIZE32(chk_length))) {
4969 				if (chk_length < sizeof(struct sctp_sack_chunk)) {
4989 				    num_dup * sizeof(uint32_t) != chk_length) {
5055 				if (chk_length < sizeof(struct sctp_nr_sack_chunk)) {
5076 				    num_dup * sizeof(uint32_t) != chk_length) {
5126 				    chk_length, *netp);
5141 			if ((stcb == NULL) || (chk_length != sizeof(struct sctp_heartbeat_chunk))) {
5175 			if ((stcb == NULL) || (chk_length != sizeof(struct sctp_shutdown_chunk))) {
5311 			if ((stcb == NULL) || chk_length != sizeof(struct sctp_cookie_ack_chunk)) {
5355 			if ((stcb == NULL) || (chk_length != sizeof(struct sctp_ecne_chunk))) {
5383 			if ((stcb == NULL) || (chk_length != sizeof(struct sctp_cwr_chunk))) {
5410 			    (length - *offset > (int)SCTP_SIZE32(chk_length))) {
5446 			if (chk_length < sizeof(struct sctp_asconf_ack_chunk)) {
5476 			if (chk_length < sizeof(struct sctp_forward_tsn_chunk)) {
5538 			if (((stcb == NULL) || (ch == NULL) || (chk_length < sizeof(struct sctp_stream_reset_tsn_req)))) {
5558 			if (chk_length < sizeof(struct sctp_pktdrop_chunk)) {
5572 				    min(chk_length, (sizeof(chunk_buf) - 4)));
5582 					auth_len = chk_length;
5591 			if ((chk_length < (sizeof(struct sctp_auth_chunk))) ||
5592 			    (chk_length > (sizeof(struct sctp_auth_chunk) +
5627 					len = min(SCTP_SIZE32(chk_length), (uint32_t) (length - *offset));
5656 		*offset += SCTP_SIZE32(chk_length);