if (len < sizeof(struct ip_esp_hdr)) { 
eh = skb_header_pointer(skb, ptr, sizeof(_esp), &_esp); if (eh == NULL) { 
match(const struct sk_buff *skb,      const struct net_device *in,      const struct net_device *out,      const void *matchinfo,      int offset,      unsigned int protoff,      int *hotdrop){	struct ip_esp_hdr _esp, *eh = NULL;	const struct ip6t_esp *espinfo = matchinfo;	unsigned int temp;	int len;	u8 nexthdr;	unsigned int ptr;	/* Make sure this isn't an evil packet */	/*DEBUGP("ipv6_esp entered \n");*/	/* type of the 1st exthdr */	nexthdr = skb->nh.ipv6h->nexthdr;	/* pointer to the 1st exthdr */	ptr = sizeof(struct ipv6hdr);	/* available length */	len = skb->len - ptr;	temp = 0;	while (ip6t_ext_hdr(nexthdr)) {		struct ipv6_opt_hdr _hdr, *hp;		int hdrlen;		DEBUGP("ipv6_esp header iteration \n");		/* Is there enough space for the next ext header? */		if (len < sizeof(struct ipv6_opt_hdr))			return 0;		/* No more exthdr -> evaluate */		if (nexthdr == NEXTHDR_NONE)			break;		/* ESP -> evaluate */		if (nexthdr == NEXTHDR_ESP) {			temp |= MASK_ESP;			break;		}		hp = skb_header_pointer(skb, ptr, sizeof(_hdr), &_hdr);		BUG_ON(hp == NULL);		/* Calculate the header length */		if (nexthdr == NEXTHDR_FRAGMENT)			hdrlen = 8;		else if (nexthdr == NEXTHDR_AUTH)			hdrlen = (hp->hdrlen+2)<<2;		else			hdrlen = ipv6_optlen(hp);		/* set the flag */		switch (nexthdr) {		case NEXTHDR_HOP:		case NEXTHDR_ROUTING:		case NEXTHDR_FRAGMENT:		case NEXTHDR_AUTH:		case NEXTHDR_DEST:			break;		default:			DEBUGP("ipv6_esp match: unknown nextheader %u\n",nexthdr);			return 0;		}		nexthdr = hp->nexthdr;		len -= hdrlen;		ptr += hdrlen;		if (ptr > skb->len) {			DEBUGP("ipv6_esp: new pointer too large! \n");			break;		}	}	/* ESP header not found */	if (temp != MASK_ESP)		return 0;	if (len < sizeof(struct ip_esp_hdr)) {		*hotdrop = 1;		return 0;	}	eh = skb_header_pointer(skb, ptr, sizeof(_esp), &_esp);	BUG_ON(eh == NULL);	DEBUGP("IPv6 ESP SPI %u %08X\n", ntohl(eh->spi), ntohl(eh->spi));	return (eh != NULL)		&& spi_match(espinfo->spis[0], espinfo->spis[1],			      ntohl(eh->spi),			      !!(espinfo->invflags & IP6T_ESP_INV_SPI));}
10457	/local/tlutelli/issta_data/temp/c/2005_temp/2005/10457/e674d0f38de6109b59dbe30fba8b296a03229b8e/ip6t_esp.c/buggy/net/ipv6/netfilter/ip6t_esp.c