706 	size_t plen;  in eapol_sm_processKey()  local
723 	plen = be_to_host16(hdr->length);  in eapol_sm_processKey()
724 	if (sizeof(*hdr) + plen > sm->last_rx_key_len || plen < sizeof(*key)) {  in eapol_sm_processKey()
790 	key_len = plen - sizeof(*key);  in eapol_sm_processKey()
1295 	size_t plen;  in eapol_sm_rx_eapol()  local
1318 	plen = be_to_host16(hdr->length);  in eapol_sm_rx_eapol()
1319 	if (plen > len - sizeof(*hdr)) {  in eapol_sm_rx_eapol()
1325 	    plen < len - sizeof(*hdr) &&  in eapol_sm_rx_eapol()
1333 		if (elen > plen && elen <= len - sizeof(*hdr)) {  in eapol_sm_rx_eapol()
1343 				   "%d -> %d", (int) plen, elen);  in eapol_sm_rx_eapol()
1344 			plen = elen;  in eapol_sm_rx_eapol()
1348 	data_len = plen + sizeof(*hdr);  in eapol_sm_rx_eapol()
1364 			if (plen >= sizeof(*ehdr) && ehdr->code == 10) {  in eapol_sm_rx_eapol()
1378 		sm->eapReqData = wpabuf_alloc_copy(hdr + 1, plen);  in eapol_sm_rx_eapol()
1397 		if (plen < sizeof(*key)) {  in eapol_sm_rx_eapol()