if (read_u32_from_xdr_buf(buf, offset, &obj->len)) 
if (xdr_decode_word(buf, offset, &obj->len)) 
xdr_buf_read_netobj(struct xdr_buf *buf, struct xdr_netobj *obj, int offset){	u32	tail_offset = buf->head[0].iov_len + buf->page_len;	u32	obj_end_offset;	if (read_u32_from_xdr_buf(buf, offset, &obj->len))		goto out;	obj_end_offset = offset + 4 + obj->len;	if (obj_end_offset <= buf->head[0].iov_len) {		/* The obj is contained entirely in the head: */		obj->data = buf->head[0].iov_base + offset + 4;	} else if (offset + 4 >= tail_offset) {		if (obj_end_offset - tail_offset				> buf->tail[0].iov_len)			goto out;		/* The obj is contained entirely in the tail: */		obj->data = buf->tail[0].iov_base			+ offset - tail_offset + 4;	} else {		/* use end of tail as storage for obj:		 * (We don't copy to the beginning because then we'd have		 * to worry about doing a potentially overlapping copy.		 * This assumes the object is at most half the length of the		 * tail.) */		if (obj->len > buf->tail[0].iov_len)			goto out;		obj->data = buf->tail[0].iov_base + buf->tail[0].iov_len - 				obj->len;		if (read_bytes_from_xdr_buf(buf, offset + 4,					obj->data, obj->len))			goto out;	}	return 0;out:	return -1;}
4520	/local/tlutelli/issta_data/temp/c/2005_temp/2005/4520/bd8100e7eda87507649c6ba4cb32173b34e49986/xdr.c/buggy/net/sunrpc/xdr.c