[DECNet] fib: Fix out of bound access of dn_fib_props[]

[DECNet] fib: Fix out of bound access of dn_fib_props[]

[Thomas Graf]

Fixes a typo which caused fib_props[] to have the wrong size
and makes sure the value used to index the array which is
provided by userspace via netlink is checked to avoid out of
bound access.

Signed-off-by: Thomas Graf <tgraf@suug.ch>

Index: net-2.6/net/decnet/dn_fib.c
===================================================================
--- net-2.6.orig/net/decnet/dn_fib.c	2007-03-24 15:59:21.000000000 +0100
+++ net-2.6/net/decnet/dn_fib.c	2007-03-24 16:20:55.000000000 +0100
@@ -63,7 +63,7 @@ static struct
 {
 	int error;
 	u8 scope;
-} dn_fib_props[RTA_MAX+1] = {
+} dn_fib_props[RTN_MAX+1] = {
 	[RTN_UNSPEC] =      { .error = 0,       .scope = RT_SCOPE_NOWHERE },
 	[RTN_UNICAST] =     { .error = 0,       .scope = RT_SCOPE_UNIVERSE },
 	[RTN_LOCAL] =       { .error = 0,       .scope = RT_SCOPE_HOST },
@@ -276,6 +276,9 @@ struct dn_fib_info *dn_fib_create_info(c
 	struct dn_fib_info *ofi;
 	int nhs = 1;
 
+	if (r->rtm_type > RTN_MAX)
+		goto err_inval;
+
 	if (dn_fib_props[r->rtm_type].scope > r->rtm_scope)
 		goto err_inval;
 

Re: [DECNet] fib: Fix out of bound access of dn_fib_props[]

[David Miller]

From: Thomas Graf <tgraf@suug.ch>
Date: Sat, 24 Mar 2007 16:35:13 +0100

> Fixes a typo which caused fib_props[] to have the wrong size
> and makes sure the value used to index the array which is
> provided by userspace via netlink is checked to avoid out of
> bound access.
> 
> Signed-off-by: Thomas Graf <tgraf@suug.ch>

Also applied, thanks Thomas.