- j = length / sizeof(*ni);
- if (j == 1
- && rp->rip6_nets->rip6_metric == HOPCNT_INFINITY6
- && IN6_IS_ADDR_UNSPECIFIED(&rp->rip6_nets->rip6_dest)) {
- ND_PRINT((ndo, " ripng-req dump"));
- break;
+ length_left = length;
+ if (length_left < (sizeof(struct rip6) - sizeof(struct netinfo6)))
+ goto trunc;
+ length_left -= (sizeof(struct rip6) - sizeof(struct netinfo6));
+ j = length_left / sizeof(*ni);
+ if (j == 1) {
+ ND_TCHECK_SIZE(rp->rip6_nets);
+ if (GET_U_1(rp->rip6_nets->rip6_metric) == HOPCNT_INFINITY6
+ && ND_IN6_IS_ADDR_UNSPECIFIED(&rp->rip6_nets->rip6_dest)) {
+ ND_PRINT(" ripng-req dump");
+ break;
+ }