- ret += pret;
- /* repeat parsing while there is still enough remaining data in buffer */
- } while((size_t) len > pos + sizeof(struct blob_attr) && (bufpt = blob_next(bufpt)));
+ ret = 0;
+
+ /* Repeat parsing while there is still enough remaining data in buffer
+ *
+ * Note that blob_next() is only valid for untrusted data because blob_parse_untrusted()
+ * verified that the buffer contains at least one blob, and that it is completely contained
+ * in the buffer */
+ bufpt = blob_next(bufpt);
+ }