[src/trunk]: src/sys/altq Reject negative indices.

[riastradh <riastradh%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/4cece5549e2f
branches:  trunk
changeset: 825686:4cece5549e2f
user:      riastradh <riastradh%NetBSD.org@localhost>
date:      Fri Jul 28 13:58:47 2017 +0000

description:
Reject negative indices.

(Would be nice to change the types too, and it's *probably* safe to
replace int by u_int, but I'm reluctant to touch the ioctl
definitions without at least a modicum more thought.  Also one of
them is a u_long, because why not?)

>From Ilja Van Sprundel.

diffstat:

 sys/altq/altq_wfq.c |  13 +++++++------
 1 files changed, 7 insertions(+), 6 deletions(-)

diffs (46 lines):

diff -r f8797df4e59c -r 4cece5549e2f sys/altq/altq_wfq.c
--- a/sys/altq/altq_wfq.c       Fri Jul 28 13:53:17 2017 +0000
+++ b/sys/altq/altq_wfq.c       Fri Jul 28 13:58:47 2017 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: altq_wfq.c,v 1.21 2016/04/20 08:58:48 knakahara Exp $  */
+/*     $NetBSD: altq_wfq.c,v 1.22 2017/07/28 13:58:47 riastradh Exp $  */
 /*     $KAME: altq_wfq.c,v 1.14 2005/04/13 03:44:25 suz Exp $  */
 
 /*
@@ -32,7 +32,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: altq_wfq.c,v 1.21 2016/04/20 08:58:48 knakahara Exp $");
+__KERNEL_RCSID(0, "$NetBSD: altq_wfq.c,v 1.22 2017/07/28 13:58:47 riastradh Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_altq.h"
@@ -517,14 +517,15 @@
        wfq *queue;
        int old;
 
-       if (swp->weight < 0) {
-               printf("set weight in natural number\n");
+       if (swp->weight < 0)
                return (EINVAL);
-       }
 
        if ((wfqp = altq_lookup(swp->iface.wfq_ifacename, ALTQT_WFQ)) == NULL)
                return (EBADF);
 
+       if (swp->qid < 0 || swp->qid >= wfqp->nums)
+               return (EINVAL);
+
        queue = &wfqp->queue[swp->qid];
        old = queue->weight;
        queue->weight = swp->weight;
@@ -543,7 +544,7 @@
        if ((wfqp = altq_lookup(gsp->iface.wfq_ifacename, ALTQT_WFQ)) == NULL)
                return (EBADF);
 
-       if (gsp->qid >= wfqp->nums)
+       if (gsp->qid < 0 || gsp->qid >= wfqp->nums)
                return (EINVAL);
 
        queue = &wfqp->queue[gsp->qid];