106 	u_char *cp;  in ip_dooptions()  local
126 	cp = (u_char *)(ip + 1);  in ip_dooptions()
128 	for (; cnt > 0; cnt -= optlen, cp += optlen) {  in ip_dooptions()
129 		opt = cp[IPOPT_OPTVAL];  in ip_dooptions()
135 			if (cnt < IPOPT_OLEN + sizeof(*cp)) {  in ip_dooptions()
136 				code = &cp[IPOPT_OLEN] - (u_char *)ip;  in ip_dooptions()
139 			optlen = cp[IPOPT_OLEN];  in ip_dooptions()
140 			if (optlen < IPOPT_OLEN + sizeof(*cp) || optlen > cnt) {  in ip_dooptions()
141 				code = &cp[IPOPT_OLEN] - (u_char *)ip;  in ip_dooptions()
163 			if (optlen < IPOPT_OFFSET + sizeof(*cp)) {  in ip_dooptions()
164 				code = &cp[IPOPT_OLEN] - (u_char *)ip;  in ip_dooptions()
167 			if ((off = cp[IPOPT_OFFSET]) < IPOPT_MINOFF) {  in ip_dooptions()
168 				code = &cp[IPOPT_OFFSET] - (u_char *)ip;  in ip_dooptions()
194 				save_rte(m, cp, ip->ip_src);  in ip_dooptions()
236 			(void)memcpy(&ipaddr.sin_addr, cp + off,  in ip_dooptions()
253 				memcpy(cp + off, &(IA_SIN(ia)->sin_addr),  in ip_dooptions()
262 				memcpy(cp + off, &(IA_SIN(nh->nh_ifa)->sin_addr),  in ip_dooptions()
267 			cp[IPOPT_OFFSET] += sizeof(struct in_addr);  in ip_dooptions()
279 			if (optlen < IPOPT_OFFSET + sizeof(*cp)) {  in ip_dooptions()
280 				code = &cp[IPOPT_OFFSET] - (u_char *)ip;  in ip_dooptions()
283 			if ((off = cp[IPOPT_OFFSET]) < IPOPT_MINOFF) {  in ip_dooptions()
284 				code = &cp[IPOPT_OFFSET] - (u_char *)ip;  in ip_dooptions()
301 				memcpy(cp + off, &(IA_SIN(ia)->sin_addr),  in ip_dooptions()
305 				memcpy(cp + off, &(IA_SIN(nh->nh_ifa)->sin_addr),  in ip_dooptions()
312 			cp[IPOPT_OFFSET] += sizeof(struct in_addr);  in ip_dooptions()
320 			code = cp - (u_char *)ip;  in ip_dooptions()
322 				code = &cp[IPOPT_OLEN] - (u_char *)ip;  in ip_dooptions()
325 			if ((off = cp[IPOPT_OFFSET]) < 5) {  in ip_dooptions()
326 				code = &cp[IPOPT_OLEN] - (u_char *)ip;  in ip_dooptions()
330 				cp[IPOPT_OFFSET + 1] += (1 << 4);  in ip_dooptions()
331 				if ((cp[IPOPT_OFFSET + 1] & 0xf0) == 0) {  in ip_dooptions()
332 					code = &cp[IPOPT_OFFSET] - (u_char *)ip;  in ip_dooptions()
338 			sin = (struct in_addr *)(cp + off);  in ip_dooptions()
339 			switch (cp[IPOPT_OFFSET + 1] & 0x0f) {  in ip_dooptions()
346 					code = &cp[IPOPT_OFFSET] - (u_char *)ip;  in ip_dooptions()
356 				cp[IPOPT_OFFSET] += sizeof(struct in_addr);  in ip_dooptions()
363 					code = &cp[IPOPT_OFFSET] - (u_char *)ip;  in ip_dooptions()
370 				cp[IPOPT_OFFSET] += sizeof(struct in_addr);  in ip_dooptions()
375 				code = &cp[IPOPT_OFFSET + 1] - (u_char *)ip;  in ip_dooptions()
379 			(void)memcpy(cp + off, &ntime, sizeof(uint32_t));  in ip_dooptions()
380 			cp[IPOPT_OFFSET] += sizeof(uint32_t);  in ip_dooptions()
559 	u_char *cp, *dp;  in ip_optcopy()  local
562 	cp = (u_char *)(ip + 1);  in ip_optcopy()
565 	for (; cnt > 0; cnt -= optlen, cp += optlen) {  in ip_optcopy()
566 		opt = cp[0];  in ip_optcopy()
576 		KASSERT(cnt >= IPOPT_OLEN + sizeof(*cp),  in ip_optcopy()
578 		optlen = cp[IPOPT_OLEN];  in ip_optcopy()
579 		KASSERT(optlen >= IPOPT_OLEN + sizeof(*cp) && optlen <= cnt,  in ip_optcopy()
586 			bcopy(cp, dp, optlen);  in ip_optcopy()
604 	u_char *cp;  in ip_pcbopts()  local
635 	cp = mtod(m, u_char *) + sizeof(struct in_addr);  in ip_pcbopts()
636 	bcopy(mtod(m, void *), cp, (unsigned)cnt);  in ip_pcbopts()
639 	for (; cnt > 0; cnt -= optlen, cp += optlen) {  in ip_pcbopts()
640 		opt = cp[IPOPT_OPTVAL];  in ip_pcbopts()
646 			if (cnt < IPOPT_OLEN + sizeof(*cp))  in ip_pcbopts()
648 			optlen = cp[IPOPT_OLEN];  in ip_pcbopts()
649 			if (optlen < IPOPT_OLEN + sizeof(*cp) || optlen > cnt)  in ip_pcbopts()
675 			cp[IPOPT_OLEN] = optlen;  in ip_pcbopts()
679 			bcopy((caddr_t)&cp[IPOPT_OFFSET+1], mtod(m, caddr_t),  in ip_pcbopts()
685 			bcopy((&cp[IPOPT_OFFSET+1] + sizeof(struct in_addr)),  in ip_pcbopts()
686 			    &cp[IPOPT_OFFSET+1],  in ip_pcbopts()
721 	u_char *cp;  in ip_checkrouteralert()  local
725 	cp = (u_char *)(ip + 1);  in ip_checkrouteralert()
727 	for (; cnt > 0; cnt -= optlen, cp += optlen) {  in ip_checkrouteralert()
728 		opt = cp[IPOPT_OPTVAL];  in ip_checkrouteralert()
735 			if (cnt < IPOPT_OLEN + sizeof(*cp))  in ip_checkrouteralert()
738 			optlen = cp[IPOPT_OLEN];  in ip_checkrouteralert()
740 			if (optlen < IPOPT_OLEN + sizeof(*cp) || optlen > cnt)  in ip_checkrouteralert()
748 			    (*((uint16_t *)&cp[IPOPT_OFFSET]) != 0))  in ip_checkrouteralert()