diff options
| author | Shaun Ruffell <sruffell@digium.com> | 2011-08-18 19:34:57 +0000 |
|---|---|---|
| committer | Shaun Ruffell <sruffell@digium.com> | 2011-08-18 19:34:57 +0000 |
| commit | 05a832c139c55d6b3d961eff0fc1ed9687f15cb8 (patch) | |
| tree | 51539c95ced403adc9220aacdfbf8ea0eac248f3 /drivers/dahdi/wct4xxp | |
| parent | 8cc8da74f224d70b67cdb585e452f92c86b9ca94 (diff) | |
wct4xxp: Bug in timing cable with different span density cards
The logic loops through the static cards[] array to determine timing,
but the subloop was based off the current card's numspans member.
This could cause a null dereference in the case where two cards of
different span densities were connected via timing cables.
Reported-by: Doug Bailey <dbailey@digium.com>
Signed-off-by: Russ Meyerriecks <rmeyerriecks@digium.com>
Origin: http://svnview.digium.com/svn/dahdi?view=rev&rev=10140
git-svn-id: http://svn.asterisk.org/svn/dahdi/linux/branches/2.5@10145 a0bf4364-ded3-4de4-8d8a-66a801d63aff
Diffstat (limited to 'drivers/dahdi/wct4xxp')
| -rw-r--r-- | drivers/dahdi/wct4xxp/base.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/dahdi/wct4xxp/base.c b/drivers/dahdi/wct4xxp/base.c index 7917aea..f1c2bed 100644 --- a/drivers/dahdi/wct4xxp/base.c +++ b/drivers/dahdi/wct4xxp/base.c @@ -2384,7 +2384,7 @@ static int __t4_findsync(struct t4 *wc) while (p < 8) { nonzero = 0; for (x=0;cards[x];x++) { - for (i = 0; i < wc->numspans; i++) { + for (i = 0; i < cards[x]->numspans; i++) { if (cards[x]->tspans[i]->syncpos) { nonzero = 1; if ((cards[x]->tspans[i]->syncpos == p) && |