add: counter--;
context: usb_parse_data(char	*format,	uchar_t 	*data,	size_t		datalen,	void		*structure,	size_t		structlen){	int	fmt;	int	counter = 1;	int	multiplier = 0;	uchar_t	*dataend = data + datalen;	char	*structstart = (char *)structure;	void	*structend = (void *)((intptr_t)structstart + structlen);	if ((format == NULL) || (data == NULL) || (structure == NULL)) {		return (USB_PARSE_ERROR);	}	while ((fmt = *format) != '\0') {		/*		 * Could some one pass a "format" that is greater than		 * the structlen? Conversely, one could pass a ret_buf_len		 * that is less than the "format" length.		 * If so, we need to protect against writing over memory.		 */		if (counter++ > structlen) {			break;		}		if (fmt == 'c') {			uint8_t	*cp = (uint8_t *)structure;			cp = (uint8_t *)(((uintptr_t)cp + _CHAR_ALIGNMENT - 1) &							~(_CHAR_ALIGNMENT - 1));			if (((data + 1) > dataend) ||			    ((cp + 1) > (uint8_t *)structend))				break;			*cp++ = *data++;			structure = (void *)cp;			if (multiplier) {				multiplier--;			}			if (multiplier == 0) {				format++;			}		} else if (fmt == 's') {			uint16_t	*sp = (uint16_t *)structure;			sp = (uint16_t *)				(((uintptr_t)sp + _SHORT_ALIGNMENT - 1) &						~(_SHORT_ALIGNMENT - 1));			if (((data + 2) > dataend) ||			    ((sp + 1) > (uint16_t *)structend))				break;			*sp++ = (data[1] << 8) + data[0];			data += 2;			structure = (void *)sp;			if (multiplier) {				multiplier--;			}			if (multiplier == 0) {				format++;			}		} else if (fmt == 'l') {			uint32_t	*lp = (uint32_t *)structure;			lp = (uint32_t *)				(((uintptr_t)lp + _INT_ALIGNMENT - 1) &							~(_INT_ALIGNMENT - 1));			if (((data + 4) > dataend) ||			    ((lp + 1) > (uint32_t *)structend))				break;			*lp++ = (((((				(uint32_t)data[3] << 8) | data[2]) << 8) |						data[1]) << 8) | data[0];			data += 4;			structure = (void *)lp;			if (multiplier) {				multiplier--;			}			if (multiplier == 0) {				format++;			}		} else if (fmt == 'L') {			uint64_t	*llp = (uint64_t *)structure;			llp = (uint64_t *)				(((uintptr_t)llp + _LONG_LONG_ALIGNMENT - 1) &						~(_LONG_LONG_ALIGNMENT - 1));			if (((data + 8) > dataend) ||			    ((llp + 1) >= (uint64_t *)structend))				break;			*llp++ = (((((((((((((data[7] << 8) |					data[6]) << 8) | data[5]) << 8) |					data[4]) << 8) | data[3]) << 8) |					data[2]) << 8) | data[1]) << 8) |					data[0];			data += 8;			structure = (void *)llp;			if (multiplier) {				multiplier--;			}			if (multiplier == 0) {				format++;			}		} else if (isdigit(fmt)) {			multiplier = (multiplier * 10) + (fmt - '0');			format++;		} else {			multiplier = 0;			break;		}	}	return ((intptr_t)structure - (intptr_t)structstart);}