@@ -6421,21 +6421,15 @@ add_option(struct options *options, char *p[], bool is_inline, const char *file,

     else if (streq(p[0], "tun-mtu-max") && p[1] && !p[2])

     {

         VERIFY_PERMISSION(OPT_P_MTU | OPT_P_CONNECTION);

-        int max_mtu = positive_atoi(p[1], msglevel);

-        if (max_mtu < 68 || max_mtu > 65536)

-        {

-            msg(msglevel, "--tun-mtu-max value '%s' is invalid", p[1]);

-        }

-        else

-        {

-            options->ce.tun_mtu_max = max_mtu;

-        }

+        atoi_constrained(p[1], &options->ce.tun_mtu_max, p[0], TUN_MTU_MAX_MIN, 65536, msglevel);

     }

     else if (streq(p[0], "tun-mtu-extra") && p[1] && !p[2])

     {

         VERIFY_PERMISSION(OPT_P_MTU | OPT_P_CONNECTION);

-        options->ce.tun_mtu_extra = positive_atoi(p[1], msglevel);

-        options->ce.tun_mtu_extra_defined = true;

+        if (atoi_constrained(p[1], &options->ce.tun_mtu_extra, p[0], 0, 65536, msglevel))

+        {

+            options->ce.tun_mtu_extra_defined = true;

+        }

     }

     else if (streq(p[0], "max-packet-size") && p[1] && !p[2])

     {

@@ -6467,11 +6461,8 @@ add_option(struct options *options, char *p[], bool is_inline, const char *file,

     else if (streq(p[0], "fragment") && p[1] && !p[3])

     {

         VERIFY_PERMISSION(OPT_P_MTU | OPT_P_CONNECTION);

-        options->ce.fragment = positive_atoi(p[1], msglevel);

-

-        if (options->ce.fragment < 68)

+        if (!atoi_constrained(p[1], &options->ce.fragment, p[0], 68, INT_MAX, msglevel))

         {

-            msg(msglevel, "--fragment needs to be at least 68");

             goto err;

         }

@@ -7145,12 +7136,14 @@ add_option(struct options *options, char *p[], bool is_inline, const char *file,

         VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_CONNECTION);

         if (p[1])

         {

-            int mssfix = positive_atoi(p[1], msglevel);

-            /* can be 0, but otherwise it needs to be high enough so we can

-             * substract room for headers. */

-            if (mssfix != 0 && (mssfix < TLS_CHANNEL_MTU_MIN || mssfix > UINT16_MAX))

+            int mssfix;

+            if (!atoi_constrained(p[1], &mssfix, p[0], 0, UINT16_MAX, msglevel))

+            {

+                goto err;

+            }

+            if (mssfix != 0 && mssfix < TLS_CHANNEL_MTU_MIN)

             {

-                msg(msglevel, "--mssfix value '%s' is invalid", p[1]);

+                msg(msglevel, "mssfix needs to be >= %d, not %d", TLS_CHANNEL_MTU_MIN, mssfix);

                 goto err;

             }

@@ -7403,7 +7396,7 @@ add_option(struct options *options, char *p[], bool is_inline, const char *file,

     else if (streq(p[0], "max-routes-per-client") && p[1] && !p[2])

     {

         VERIFY_PERMISSION(OPT_P_INHERIT);

-        options->max_routes_per_client = max_int(positive_atoi(p[1], msglevel), 1);

+        atoi_constrained(p[1], &options->max_routes_per_client, p[0], 1, INT_MAX, msglevel);

     }

     else if (streq(p[0], "client-cert-not-required") && !p[1])

     {

@@ -9222,8 +9215,6 @@ add_option(struct options *options, char *p[], bool is_inline, const char *file,

     }

     else if (streq(p[0], "keying-material-exporter") && p[1] && p[2])

     {

-        int ekm_length = positive_atoi(p[2], msglevel);

-

         VERIFY_PERMISSION(OPT_P_GENERAL);

         if (strncmp(p[1], "EXPORTER", 8))

@@ -9237,14 +9228,14 @@ add_option(struct options *options, char *p[], bool is_inline, const char *file,

             msg(msglevel,

                 "Keying material exporter label must not be '" EXPORT_KEY_DATA_LABEL "'.");

         }

-        if (ekm_length < 16 || ekm_length > 4095)

+

+        if (!atoi_constrained(p[2], &options->keying_material_exporter_length,

+                              p[0], 16, 4095, msglevel))

         {

-            msg(msglevel, "Invalid keying material exporter length");

             goto err;

         }

         options->keying_material_exporter_label = p[1];

-        options->keying_material_exporter_length = ekm_length;

     }

     else if (streq(p[0], "allow-recursive-routing") && !p[1])

     {

@@ -9279,15 +9270,14 @@ add_option(struct options *options, char *p[], bool is_inline, const char *file,

     }

     else if (streq(p[0], "vlan-pvid") && p[1] && !p[2])

     {

+        int vlan_pvid;

         VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_INSTANCE);

-        options->vlan_pvid = positive_atoi(p[1], msglevel);

-        if (options->vlan_pvid < OPENVPN_8021Q_MIN_VID

-            || options->vlan_pvid > OPENVPN_8021Q_MAX_VID)

+        if (!atoi_constrained(p[1], &vlan_pvid, p[0],

+                              OPENVPN_8021Q_MIN_VID, OPENVPN_8021Q_MAX_VID, msglevel))

         {

-            msg(msglevel, "the parameter of --vlan-pvid parameters must be >= %u and <= %u",

-                OPENVPN_8021Q_MIN_VID, OPENVPN_8021Q_MAX_VID);

             goto err;

         }

+        options->vlan_pvid = (uint16_t)vlan_pvid;

     }

     else

     {