191 		if (sizeof(*r) + r->ie_len + r->beacon_ie_len > (size_t) len) {  in wpa_driver_privsep_get_scan_results2()
194 				   (int) sizeof(*r), (int) r->ie_len,  in wpa_driver_privsep_get_scan_results2()
262 	buflen = sizeof(*data) + params->ie_len + params->auth_data_len;  in wpa_driver_privsep_authenticate()
272 	data->ie_len = params->ie_len;  in wpa_driver_privsep_authenticate()
283 	if (params->ie_len) {  in wpa_driver_privsep_authenticate()
284 		os_memcpy(pos, params->ie, params->ie_len);  in wpa_driver_privsep_authenticate()
285 		pos += params->ie_len;  in wpa_driver_privsep_authenticate()
420 	int ie_len;  in wpa_driver_privsep_event_assoc()  local
429 	os_memcpy(&ie_len, pos, sizeof(int));  in wpa_driver_privsep_event_assoc()
431 	if (ie_len < 0 || ie_len > end - pos)  in wpa_driver_privsep_event_assoc()
433 	if (ie_len) {  in wpa_driver_privsep_event_assoc()
435 		data.assoc_info.req_ies_len = ie_len;  in wpa_driver_privsep_event_assoc()
436 		pos += ie_len;  in wpa_driver_privsep_event_assoc()