diff options
| author | russell <russell@5390a7c7-147a-4af0-8ec9-7488f05a26cb> | 2006-10-17 16:45:27 +0000 |
|---|---|---|
| committer | russell <russell@5390a7c7-147a-4af0-8ec9-7488f05a26cb> | 2006-10-17 16:45:27 +0000 |
| commit | bb35e6844acf01f737893a5bade890be4a65c055 (patch) | |
| tree | 4ec22e5ddb8e43bf796dd738fef6645df2073430 /wct4xxp | |
| parent | 1b24a0cdd60aa17ac5e87731eb2e2b742e615e36 (diff) | |
Merged revisions 1507 via svnmerge from
https://origsvn.digium.com/svn/zaptel/branches/1.4
........
r1507 | russell | 2006-10-17 12:40:45 -0400 (Tue, 17 Oct 2006) | 4 lines
Set the readbuf size to be the same size of the variable, readsize. This buffer
was 31 bytes, while the readsize could be 32 bytes, causing a read into invalid
memory. (issue #8155, araasch)
........
git-svn-id: http://svn.digium.com/svn/zaptel/trunk@1508 5390a7c7-147a-4af0-8ec9-7488f05a26cb
Diffstat (limited to 'wct4xxp')
| -rw-r--r-- | wct4xxp/base.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/wct4xxp/base.c b/wct4xxp/base.c index b26307e..72afb05 100644 --- a/wct4xxp/base.c +++ b/wct4xxp/base.c @@ -2637,7 +2637,7 @@ static inline void __t4_framer_interrupt(struct t4 *wc, int span) if (readsize > 0) { struct zt_chan *sigchan = ts->sigchan; int i; - unsigned char readbuf[FRMR_RBCL_MAX_SIZE]; + unsigned char readbuf[readsize]; if (debug & DEBUG_FRAMER) printk("Framer %d: Got RPF/RME! readsize is %d\n", sigchan->span->offset, readsize); |