108 	int opt, optlen, cnt, off, code, type = ICMP_PARAMPROB, forward = 0;  in ip_dooptions()  local
127 	cnt = (ip->ip_hl << 2) - sizeof (struct ip);  in ip_dooptions()
128 	for (; cnt > 0; cnt -= optlen, cp += optlen) {  in ip_dooptions()
135 			if (cnt < IPOPT_OLEN + sizeof(*cp)) {  in ip_dooptions()
140 			if (optlen < IPOPT_OLEN + sizeof(*cp) || optlen > cnt) {  in ip_dooptions()
560 	int opt, optlen, cnt;  in ip_optcopy()  local
564 	cnt = (ip->ip_hl << 2) - sizeof (struct ip);  in ip_optcopy()
565 	for (; cnt > 0; cnt -= optlen, cp += optlen) {  in ip_optcopy()
576 		KASSERT(cnt >= IPOPT_OLEN + sizeof(*cp),  in ip_optcopy()
579 		KASSERT(optlen >= IPOPT_OLEN + sizeof(*cp) && optlen <= cnt,  in ip_optcopy()
583 		if (optlen > cnt)  in ip_optcopy()
584 			optlen = cnt;  in ip_optcopy()
603 	int cnt, optlen;  in ip_pcbopts()  local
633 	cnt = m->m_len;  in ip_pcbopts()
636 	bcopy(mtod(m, void *), cp, (unsigned)cnt);  in ip_pcbopts()
639 	for (; cnt > 0; cnt -= optlen, cp += optlen) {  in ip_pcbopts()
646 			if (cnt < IPOPT_OLEN + sizeof(*cp))  in ip_pcbopts()
649 			if (optlen < IPOPT_OLEN + sizeof(*cp) || optlen > cnt)  in ip_pcbopts()
673 			cnt -= sizeof(struct in_addr);  in ip_pcbopts()
687 			    (unsigned)cnt - (IPOPT_MINOFF - 1));  in ip_pcbopts()
722 	int opt, optlen, cnt, found_ra;  in ip_checkrouteralert()  local
726 	cnt = (ip->ip_hl << 2) - sizeof (struct ip);  in ip_checkrouteralert()
727 	for (; cnt > 0; cnt -= optlen, cp += optlen) {  in ip_checkrouteralert()
735 			if (cnt < IPOPT_OLEN + sizeof(*cp))  in ip_checkrouteralert()
740 			if (optlen < IPOPT_OLEN + sizeof(*cp) || optlen > cnt)  in ip_checkrouteralert()