From 7dbe8c05fbcf4146343416e95c59fb60fc02ae59 Mon Sep 17 00:00:00 2001 From: Shaun Ruffell Date: Wed, 12 Oct 2011 16:32:49 +0000 Subject: wct4xxp: Bug in timing cable with different span density cards The logic loops through the static cards[] array to determine timing, but the subloop was based off the current card's numspans member. This could cause a null dereference in the case where two cards of different span densities were connected via timing cables. Reported-by: Doug Bailey Signed-off-by: Russ Meyerriecks Origin: http://svnview.digium.com/svn/dahdi?view=rev&rev=10140 git-svn-id: http://svn.asterisk.org/svn/dahdi/linux/branches/2.4@10222 a0bf4364-ded3-4de4-8d8a-66a801d63aff --- drivers/dahdi/wct4xxp/base.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/dahdi/wct4xxp/base.c b/drivers/dahdi/wct4xxp/base.c index 81ef89e..15f6536 100644 --- a/drivers/dahdi/wct4xxp/base.c +++ b/drivers/dahdi/wct4xxp/base.c @@ -2353,7 +2353,7 @@ static int __t4_findsync(struct t4 *wc) while (p < 8) { nonzero = 0; for (x=0;cards[x];x++) { - for (i = 0; i < wc->numspans; i++) { + for (i = 0; i < cards[x]->numspans; i++) { if (cards[x]->tspans[i]->syncpos) { nonzero = 1; if ((cards[x]->tspans[i]->syncpos == p) && -- cgit v1.2.3