rem: if (off > optlen - sizeof(struct in_addr))
add: if (off > (int) (optlen - sizeof(struct in_addr)))
context: static int ip_dooptions(struct mbuf *m){	struct ip *ip = mtod(m, struct ip*);	uint8 *cp;	struct in_addr dst, *sin;	struct sockaddr_in ipaddr;	int cnt, optlen, opt, code, off;	int type = ICMP_PARAMPROB;	int forward = 0;	struct in_ifaddr *ia;	struct ip_timestamp*ipt;	n_time ntime;printf("ip_dooptions\n");		dst = ip->ip_dst;	cp = (uint8*)(ip + 1);	cnt = (ip->ip_hl << 2) - sizeof(struct ip);	for (; cnt > 0; cnt -= optlen, cp+= optlen) {		opt = cp[IPOPT_OPTVAL];		if (opt == IPOPT_EOL)			break;		if (opt == IPOPT_NOP)			optlen = 1;		else {			optlen = cp[IPOPT_OLEN];			if (optlen <= 0 || optlen > cnt) {				code = &cp[IPOPT_OLEN] - (uint8 *)ip;				goto bad;			}		}		switch (opt) {			case IPOPT_LSRR:			case IPOPT_SSRR:				if ((off = cp[IPOPT_OFFSET]) < IPOPT_MINOFF) {					code = &cp[IPOPT_OFFSET] - (uint8 *)ip;					goto bad;				}				ipaddr.sin_addr = ip->ip_dst;				ia = (struct in_ifaddr*)ifa_ifwithaddr((struct sockaddr*)&ipaddr);				if (ia == NULL) {					if (opt == IPOPT_SSRR) {						type = ICMP_UNREACH;						code = ICMP_UNREACH_SRCFAIL;						goto bad;					}					break;				}				off--;				if (off > optlen - sizeof(struct in_addr)) {					save_rte(cp, ip->ip_src);					break;				}				memcpy(&ipaddr.sin_addr, cp+off, sizeof(ipaddr.sin_addr));				if (opt == IPOPT_SSRR) {					if ((ia = (INA) ifa_ifwithdstaddr((SA)&ipaddr)) == NULL)						ia = (INA) ifa_ifwithnet((SA)&ipaddr);				} else 					ia = ip_rtaddr(ipaddr.sin_addr);				if (ia == NULL) {					type = ICMP_UNREACH;					code = ICMP_UNREACH_SRCFAIL;					goto bad;				}				ip->ip_dst = ipaddr.sin_addr;				memcpy(cp+off, &(IA_SIN(ia)->sin_addr), sizeof(struct in_addr));				cp[IPOPT_OFFSET] += sizeof(struct in_addr);				forward = !IN_MULTICAST(ntohl(ip->ip_dst.s_addr));				break;			case IPOPT_RR:				if ((off = cp[IPOPT_OFFSET]) < IPOPT_MINOFF) {					code = &cp[IPOPT_OFFSET] - (uint8*)ip;					goto bad;				}				off--;				if (off > optlen - sizeof(struct in_addr))					break;				memcpy(&ipaddr.sin_addr, &ip->ip_dst, sizeof(ipaddr.sin_addr));				if ((ia = (INA)ifa_ifwithaddr((SA)&ipaddr)) == NULL &&				    (ia = ip_rtaddr(ipaddr.sin_addr)) == NULL) {					type = ICMP_UNREACH;					code = ICMP_UNREACH_HOST;					goto bad;				}				memcpy(cp+off, &(IA_SIN(ia)->sin_addr), sizeof(struct in_addr));				cp[IPOPT_OFFSET] += sizeof(struct in_addr);				break;			case IPOPT_TS:				code = cp - (uint8*)ip;				ipt = (struct ip_timestamp *)cp;				if (ipt->ipt_len < 5)					goto bad;				if (ipt->ipt_ptr > ipt->ipt_len - sizeof(uint32)) {					if (++ipt->ipt_oflw == 0)						goto bad;					break;				}				sin = (struct in_addr *)(cp + ipt->ipt_ptr - 1);				switch (ipt->ipt_flg) {					case IPOPT_TS_TSONLY:						break;					case IPOPT_TS_TSANDADDR:						if (ipt->ipt_ptr + sizeof(n_time) + 						    sizeof(struct in_addr) > ipt->ipt_len)							goto bad;						ipaddr.sin_addr = dst;						ia = (INA)ifaof_ifpforaddr((SA) &ipaddr, m->m_pkthdr.rcvif);						if (!ia)							continue;						memcpy(sin, &IA_SIN(ia)->sin_addr, sizeof(struct in_addr));						ipt->ipt_ptr += sizeof(struct in_addr);						break;					case IPOPT_TS_PRESPEC:						if (ipt->ipt_ptr + sizeof(n_time) +						    sizeof(struct in_addr) > ipt->ipt_len)							goto bad;						memcpy(&ipaddr.sin_addr, sin, sizeof(struct in_addr));						if (ifa_ifwithaddr((SA)&ipaddr) == 0)							continue;						ipt->ipt_ptr += sizeof(struct in_addr);						break;					default:						goto bad;				}				ntime = iptime();				memcpy(cp+ipt->ipt_ptr - 1, &ntime, sizeof(n_time));				ipt->ipt_ptr += sizeof(n_time);			default:				break;		}	}	if (forward) {		ip_forward(m, 1);		return 1;	}	return 0;bad:	ip->ip_len -= ip->ip_hl << 2;	icmp->error(m, type, code, 0, 0);	ipstat.ips_badoptions++;	return 1;}