1783 	ipfw_obj_ctlv *ctlv;  in dump_named_objects()  local
1788 	ctlv = (ipfw_obj_ctlv *)ipfw_get_sopt_space(sd, sizeof(*ctlv));  in dump_named_objects()
1789 	if (ctlv == NULL)  in dump_named_objects()
1791 	ctlv->head.type = IPFW_TLV_TBLNAME_LIST;  in dump_named_objects()
1792 	ctlv->head.length = da->tcount * sizeof(ipfw_obj_ntlv) +  in dump_named_objects()
1793 	    sizeof(*ctlv);  in dump_named_objects()
1794 	ctlv->count = da->tcount;  in dump_named_objects()
1795 	ctlv->objsize = sizeof(ipfw_obj_ntlv);  in dump_named_objects()
1815 	ipfw_obj_ctlv *ctlv;  in dump_static_rules()  local
1821 	ctlv = (ipfw_obj_ctlv *)ipfw_get_sopt_space(sd, sizeof(*ctlv));  in dump_static_rules()
1822 	if (ctlv == NULL)  in dump_static_rules()
1824 	ctlv->head.type = IPFW_TLV_RULE_LIST;  in dump_static_rules()
1825 	ctlv->head.length = da->rsize + sizeof(*ctlv);  in dump_static_rules()
1826 	ctlv->count = da->rcount;  in dump_static_rules()
2299 	if (ci->ctlv != NULL) {  in rewrite_rule_uidx()
2300 		ti.tlvs = (void *)(ci->ctlv + 1);  in rewrite_rule_uidx()
2301 		ti.tlen = ci->ctlv->head.length - sizeof(ipfw_obj_ctlv);  in rewrite_rule_uidx()
2358 	ipfw_obj_ctlv *ctlv, *rtlv, *tstate;  in parse_rules_v1()  local
2367 	ctlv = (ipfw_obj_ctlv *)(op3 + 1);  in parse_rules_v1()
2369 	if (read + sizeof(*ctlv) > sd->valsize)  in parse_rules_v1()
2376 	if (ctlv->head.type == IPFW_TLV_TBLNAME_LIST) {  in parse_rules_v1()
2378 		clen = ctlv->head.length;  in parse_rules_v1()
2379 		if (read + clen > sd->valsize || clen < sizeof(*ctlv) ||  in parse_rules_v1()
2383 		count = (ctlv->head.length - sizeof(*ctlv)) / sizeof(*ntlv);  in parse_rules_v1()
2384 		if (ctlv->count != count || ctlv->objsize != sizeof(*ntlv))  in parse_rules_v1()
2392 		ntlv = (ipfw_obj_ntlv *)(ctlv + 1);  in parse_rules_v1()
2409 		tstate = ctlv;  in parse_rules_v1()
2410 		read += ctlv->head.length;  in parse_rules_v1()
2411 		ctlv = (ipfw_obj_ctlv *)((caddr_t)ctlv + ctlv->head.length);  in parse_rules_v1()
2413 		if (read + sizeof(*ctlv) > sd->valsize)  in parse_rules_v1()
2418 	if (ctlv->head.type == IPFW_TLV_RULE_LIST) {  in parse_rules_v1()
2419 		clen = ctlv->head.length;  in parse_rules_v1()
2420 		if (read + clen > sd->valsize || clen < sizeof(*ctlv) ||  in parse_rules_v1()
2424 		clen -= sizeof(*ctlv);  in parse_rules_v1()
2425 		if (ctlv->count == 0 ||  in parse_rules_v1()
2426 		    ctlv->count > clen / sizeof(struct ip_fw_rule))  in parse_rules_v1()
2430 		cbuf = malloc(ctlv->count * sizeof(struct rule_check_info),  in parse_rules_v1()
2442 		r = (struct ip_fw_rule *)(ctlv + 1);  in parse_rules_v1()
2445 			if (rsize > clen || count > ctlv->count) {  in parse_rules_v1()
2449 			ci->ctlv = tstate;  in parse_rules_v1()
2471 		if (ctlv->count != count || error != 0) {  in parse_rules_v1()
2476 		rtlv = ctlv;  in parse_rules_v1()
2477 		read += ctlv->head.length;  in parse_rules_v1()
2478 		ctlv = (ipfw_obj_ctlv *)((caddr_t)ctlv + ctlv->head.length);  in parse_rules_v1()