--- sch_gred.c 2002/11/20 11:36:22 1.1 +++ sch_gred.c 2002/11/20 11:38:57 @@ -328,18 +328,20 @@ struct tc_gred_qopt *ctl; struct tc_gred_sopt *sopt; struct rtattr *tb[TCA_GRED_STAB]; - struct rtattr *tb2[TCA_GRED_STAB]; + struct rtattr *tb2[TCA_GRED_DPS]; int i; if (opt == NULL || rtattr_parse(tb, TCA_GRED_STAB, RTA_DATA(opt), RTA_PAYLOAD(opt)) ) return -EINVAL; - if (tb[TCA_GRED_PARMS-1] == 0 && tb[TCA_GRED_STAB-1] == 0 && - tb[TCA_GRED_DPS-1] != 0) { + if (tb[TCA_GRED_PARMS-1] == 0 && tb[TCA_GRED_STAB-1] == 0) { rtattr_parse(tb2, TCA_GRED_DPS, RTA_DATA(opt), RTA_PAYLOAD(opt)); + if (tb2[TCA_GRED_DPS-1] == 0) + return -EINVAL; + sopt = RTA_DATA(tb2[TCA_GRED_DPS-1]); table->DPs=sopt->DPs; table->def=sopt->def_DP; @@ -471,15 +473,17 @@ struct gred_sched *table = (struct gred_sched *)sch->data; struct tc_gred_sopt *sopt; struct rtattr *tb[TCA_GRED_STAB]; - struct rtattr *tb2[TCA_GRED_STAB]; + struct rtattr *tb2[TCA_GRED_DPS]; if (opt == NULL || rtattr_parse(tb, TCA_GRED_STAB, RTA_DATA(opt), RTA_PAYLOAD(opt)) ) return -EINVAL; - if (tb[TCA_GRED_PARMS-1] == 0 && tb[TCA_GRED_STAB-1] == 0 && - tb[TCA_GRED_DPS-1] != 0) { + if (tb[TCA_GRED_PARMS-1] == 0 && tb[TCA_GRED_STAB-1] == 0) { rtattr_parse(tb2, TCA_GRED_DPS, RTA_DATA(opt),RTA_PAYLOAD(opt)); + + if (tb2[TCA_GRED_DPS-1] == 0) + return -EINVAL; sopt = RTA_DATA(tb2[TCA_GRED_DPS-1]); table->DPs=sopt->DPs;