333 	u16 slen;  in p2p_rx_gas_initial_req()  local
363 	slen = *pos++;  in p2p_rx_gas_initial_req()
364 	if (slen > end - pos || slen < 2) {  in p2p_rx_gas_initial_req()
368 	next = pos + slen;  in p2p_rx_gas_initial_req()
381 	slen = WPA_GET_LE16(pos);  in p2p_rx_gas_initial_req()
383 	if (slen > end - pos)  in p2p_rx_gas_initial_req()
385 	end = pos + slen;  in p2p_rx_gas_initial_req()
396 	slen = WPA_GET_LE16(pos);  in p2p_rx_gas_initial_req()
398 	if (slen > end - pos || slen < 3 + 1) {  in p2p_rx_gas_initial_req()
489 	u16 slen;  in p2p_rx_gas_initial_resp()  local
538 	slen = *pos++;  in p2p_rx_gas_initial_resp()
539 	if (slen > end - pos || slen < 2) {  in p2p_rx_gas_initial_resp()
543 	next = pos + slen;  in p2p_rx_gas_initial_resp()
558 	slen = WPA_GET_LE16(pos);  in p2p_rx_gas_initial_resp()
560 	p2p_dbg(p2p, "Query Response Length: %d", slen);  in p2p_rx_gas_initial_resp()
561 	if (slen > end - pos) {  in p2p_rx_gas_initial_resp()
565 	end = pos + slen;  in p2p_rx_gas_initial_resp()
587 	slen = WPA_GET_LE16(pos);  in p2p_rx_gas_initial_resp()
589 	if (slen > end - pos || slen < 3 + 1) {  in p2p_rx_gas_initial_resp()
712 	u16 slen;  in p2p_rx_gas_comeback_resp()  local
760 	slen = *pos++;  in p2p_rx_gas_comeback_resp()
761 	if (slen > end - pos || slen < 2) {  in p2p_rx_gas_comeback_resp()
765 	next = pos + slen;  in p2p_rx_gas_comeback_resp()
780 	slen = WPA_GET_LE16(pos);  in p2p_rx_gas_comeback_resp()
782 	p2p_dbg(p2p, "Query Response Length: %d", slen);  in p2p_rx_gas_comeback_resp()
783 	if (slen > end - pos) {  in p2p_rx_gas_comeback_resp()
787 	if (slen == 0) {  in p2p_rx_gas_comeback_resp()
791 	end = pos + slen;  in p2p_rx_gas_comeback_resp()
810 	slen = WPA_GET_LE16(pos);  in p2p_rx_gas_comeback_resp()
812 	p2p_dbg(p2p, "ANQP Query Response length: %u", slen);  in p2p_rx_gas_comeback_resp()
813 	if (slen < 3 + 1) {  in p2p_rx_gas_comeback_resp()