[SCH_GRED]: Array overflow fixes, found by Stanford checker.

diff --git a/net/sched/sch_gred.c b/net/sched/sch_gred.c
index 41aa7623ebe8a64420fc1f6b5216613f1c2fd5f1..2ae93cbd8cc3a4a5e04a76b0c4549df142dbb1f2 100644 (file)
--- a/net/sched/sch_gred.c
+++ b/net/sched/sch_gred.c
@@ -328,18 +328,20 @@ static int gred_change(struct Qdisc *sch, struct rtattr *opt)
        struct tc_gred_qopt *ctl;
        struct tc_gred_sopt *sopt;
        struct rtattr *tb[TCA_GRED_STAB];
-       struct rtattr *tb2[TCA_GRED_STAB];
+       struct rtattr *tb2[TCA_GRED_DPS];
        int i;
 
        if (opt == NULL ||
                rtattr_parse(tb, TCA_GRED_STAB, RTA_DATA(opt), RTA_PAYLOAD(opt)) )
                        return -EINVAL;
 
-       if (tb[TCA_GRED_PARMS-1] == 0 && tb[TCA_GRED_STAB-1] == 0 &&
-           tb[TCA_GRED_DPS-1] != 0) {
+       if (tb[TCA_GRED_PARMS-1] == 0 && tb[TCA_GRED_STAB-1] == 0) {
                rtattr_parse(tb2, TCA_GRED_DPS, RTA_DATA(opt),
                    RTA_PAYLOAD(opt));
 
+           if (tb2[TCA_GRED_DPS-1] == 0) 
+                       return -EINVAL;
+
                sopt = RTA_DATA(tb2[TCA_GRED_DPS-1]);
                table->DPs=sopt->DPs;   
                table->def=sopt->def_DP; 
@@ -471,16 +473,18 @@ static int gred_init(struct Qdisc *sch, struct rtattr *opt)
        struct gred_sched *table = (struct gred_sched *)sch->data;
        struct tc_gred_sopt *sopt;
        struct rtattr *tb[TCA_GRED_STAB];
-       struct rtattr *tb2[TCA_GRED_STAB];
+       struct rtattr *tb2[TCA_GRED_DPS];
 
        if (opt == NULL ||
                rtattr_parse(tb, TCA_GRED_STAB, RTA_DATA(opt), RTA_PAYLOAD(opt)) )
                        return -EINVAL;
 
-       if (tb[TCA_GRED_PARMS-1] == 0 && tb[TCA_GRED_STAB-1] == 0 &&
-           tb[TCA_GRED_DPS-1] != 0) {
+       if (tb[TCA_GRED_PARMS-1] == 0 && tb[TCA_GRED_STAB-1] == 0) {
                rtattr_parse(tb2, TCA_GRED_DPS, RTA_DATA(opt),RTA_PAYLOAD(opt));
 
+           if (tb2[TCA_GRED_DPS-1] == 0) 
+                       return -EINVAL;
+
                sopt = RTA_DATA(tb2[TCA_GRED_DPS-1]);
                table->DPs=sopt->DPs;   
                table->def=sopt->def_DP;