 oh = skb_header_pointer(skb, ptr, sizeof(_optsh), &_optsh); BUG_ON(oh == NULL); 
match(const struct sk_buff *skb,      const struct net_device *in,      const struct net_device *out,      const void *matchinfo,      int offset,      unsigned int protoff,      int *hotdrop){       struct ipv6_opt_hdr _optsh, *oh;       const struct ip6t_opts *optinfo = matchinfo;       unsigned int temp;       unsigned int len;       u8 nexthdr;       unsigned int ptr;       unsigned int hdrlen = 0;       unsigned int ret = 0;       u8 _opttype, *tp = NULL;       u8 _optlen, *lp = NULL;       unsigned int optlen;              /* type of the 1st exthdr */       nexthdr = skb->nh.ipv6h->nexthdr;       /* pointer to the 1st exthdr */       ptr = sizeof(struct ipv6hdr);       /* available length */       len = skb->len - ptr;       temp = 0;        while (ip6t_ext_hdr(nexthdr)) {               struct ipv6_opt_hdr _hdr, *hp;              DEBUGP("ipv6_opts header iteration \n");              /* Is there enough space for the next ext header? */                if (len < (int)sizeof(struct ipv6_opt_hdr))                        return 0;              /* No more exthdr -> evaluate */                if (nexthdr == NEXTHDR_NONE) {                     break;              }              /* ESP -> evaluate */                if (nexthdr == NEXTHDR_ESP) {                     break;              }	      hp = skb_header_pointer(skb, ptr, sizeof(_hdr), &_hdr);	      BUG_ON(hp == NULL);              /* Calculate the header length */                if (nexthdr == NEXTHDR_FRAGMENT) {                        hdrlen = 8;                } else if (nexthdr == NEXTHDR_AUTH)                        hdrlen = (hp->hdrlen+2)<<2;                else                        hdrlen = ipv6_optlen(hp);              /* OPTS -> evaluate */#if HOPBYHOP                if (nexthdr == NEXTHDR_HOP) {                     temp |= MASK_HOPOPTS;#else                if (nexthdr == NEXTHDR_DEST) {                     temp |= MASK_DSTOPTS;#endif                     break;              }              /* set the flag */              switch (nexthdr){                     case NEXTHDR_HOP:                     case NEXTHDR_ROUTING:                     case NEXTHDR_FRAGMENT:                     case NEXTHDR_AUTH:                     case NEXTHDR_DEST:                            break;                     default:                            DEBUGP("ipv6_opts match: unknown nextheader %u\n",nexthdr);                            return 0;                            break;              }                nexthdr = hp->nexthdr;                len -= hdrlen;                ptr += hdrlen;		if ( ptr > skb->len ) {			DEBUGP("ipv6_opts: new pointer is too large! \n");			break;		}        }       /* OPTIONS header not found */#if HOPBYHOP       if ( temp != MASK_HOPOPTS ) return 0;#else       if ( temp != MASK_DSTOPTS ) return 0;#endif       if (len < (int)sizeof(struct ipv6_opt_hdr)){	       *hotdrop = 1;       		return 0;       }       if (len < hdrlen){	       /* Packet smaller than it's length field */       		return 0;       }       oh = skb_header_pointer(skb, ptr, sizeof(_optsh), &_optsh);       BUG_ON(oh == NULL);       DEBUGP("IPv6 OPTS LEN %u %u ", hdrlen, oh->hdrlen);       DEBUGP("len %02X %04X %02X ",       		optinfo->hdrlen, hdrlen,       		(!(optinfo->flags & IP6T_OPTS_LEN) ||                           ((optinfo->hdrlen == hdrlen) ^                           !!(optinfo->invflags & IP6T_OPTS_INV_LEN))));       ret = (oh != NULL)       		&&	      	(!(optinfo->flags & IP6T_OPTS_LEN) ||                           ((optinfo->hdrlen == hdrlen) ^                           !!(optinfo->invflags & IP6T_OPTS_INV_LEN)));       ptr += 2;       hdrlen -= 2;       if ( !(optinfo->flags & IP6T_OPTS_OPTS) ){	       return ret;	} else if (optinfo->flags & IP6T_OPTS_NSTRICT) {		DEBUGP("Not strict - not implemented");	} else {		DEBUGP("Strict ");		DEBUGP("#%d ",optinfo->optsnr);		for(temp=0; temp<optinfo->optsnr; temp++){			/* type field exists ? */			if (hdrlen < 1)				break;			tp = skb_header_pointer(skb, ptr, sizeof(_opttype),						&_opttype);			if (tp == NULL)				break;			/* Type check */			if (*tp != (optinfo->opts[temp] & 0xFF00)>>8){				DEBUGP("Tbad %02X %02X\n",				       *tp,				       (optinfo->opts[temp] & 0xFF00)>>8);				return 0;			} else {				DEBUGP("Tok ");			}			/* Length check */			if (*tp) {				u16 spec_len;				/* length field exists ? */				if (hdrlen < 2)					break;				lp = skb_header_pointer(skb, ptr + 1,							sizeof(_optlen),							&_optlen);				if (lp == NULL)					break;				spec_len = optinfo->opts[temp] & 0x00FF;				if (spec_len != 0x00FF && spec_len != *lp) {					DEBUGP("Lbad %02X %04X\n", *lp,					       spec_len);					return 0;				}				DEBUGP("Lok ");				optlen = *lp + 2;			} else {				DEBUGP("Pad1\n");				optlen = 1;			}			/* Step to the next */			DEBUGP("len%04X \n", optlen);			if ((ptr > skb->len - optlen || hdrlen < optlen) &&			    (temp < optinfo->optsnr - 1)) {				DEBUGP("new pointer is too large! \n");				break;			}			ptr += optlen;			hdrlen -= optlen;		}		if (temp == optinfo->optsnr)			return ret;		else return 0;	}	return 0;}
10457	/local/tlutelli/issta_data/temp/c/2005_temp/2005/10457/e674d0f38de6109b59dbe30fba8b296a03229b8e/ip6t_hbh.c/clean/net/ipv6/netfilter/ip6t_hbh.c