#endif
for (i = n->sel.nkeys; i>0; i--, key++) {
- unsigned int toff;
+ int toff = off + key->off + (off2 & key->offmask);
__be32 *data, _data;
- toff = off + key->off + (off2 & key->offmask);
+ if (skb_headroom(skb) + toff > INT_MAX)
+ goto out;
+
data = skb_header_pointer(skb, toff, 4, &_data);
if (!data)
goto out;