4 files changed, 16 insertions, 2 deletions
diff --git a/tor2.c b/tor2.c
index c662cc1..a52c2e4 100644
--- a/tor2.c
+++ b/tor2.c
@@ -203,6 +203,13 @@ static int tor2_spanconfig(struct zt_span *span, struct zt_lineconfig *lc)
 
 	if (debug)
 		printk("Tor2: Configuring span %d\n", span->spanno);
+
+	if ((lc->sync < 0) || (lc->sync >= SPANS_PER_CARD)) {
+		printk(KERN_WARNING "%s %d: invalid span timing value %d.\n",
+				THIS_MODULE->name, span->spanno, lc->sync);
+		return -EINVAL;
+	}
+
 	/* XXX We assume lineconfig is okay and shouldn't XXX */	
 	span->lineconfig = lc->lineconfig;
 	span->txlevel = lc->lbo;
diff --git a/torisa.c b/torisa.c
index 3b3b163..3af2123 100644
--- a/torisa.c
+++ b/torisa.c
@@ -602,6 +602,13 @@ static int torisa_spanconfig(struct zt_span *span, struct zt_lineconfig *lc)
 {
 	if (debug)
 		printk("TorISA: Configuring span %d\n", span->spanno);
+
+	if ((lc->sync < 0) || (lc->sync >= 2)) {
+		printk(KERN_WARNING "%s %d: invalid span timing value %d.\n",
+				THIS_MODULE->name, span->spanno, lc->sync);
+		return -EINVAL;
+	}
+
 	/* XXX We assume lineconfig is okay and shouldn't XXX */	
 	span->lineconfig = lc->lineconfig;
 	span->txlevel = lc->lbo;
diff --git a/wct1xxp.c b/wct1xxp.c
index 03be58b..52a19da 100644
--- a/wct1xxp.c
+++ b/wct1xxp.c
@@ -738,7 +738,7 @@ static int t1xxp_spanconfig(struct zt_span *span, struct zt_lineconfig *lc)
 	span->txlevel = lc->lbo;
 	span->rxlevel = 0;
 	/* Do we want to SYNC on receive or not */
-	wc->sync = lc->sync;
+	wc->sync = (lc->sync) ? 1 : 0;
 	/* If already running, apply changes immediately */
 	if (span->flags & ZT_FLAG_RUNNING)
 		return t1xxp_startup(span);
diff --git a/wcte11xp.c b/wcte11xp.c
index 016f205..d79b69c 100644
--- a/wcte11xp.c
+++ b/wcte11xp.c
@@ -932,7 +932,7 @@ static int t1xxp_spanconfig(struct zt_span *span, struct zt_lineconfig *lc)
 	span->txlevel = lc->lbo;
 	span->rxlevel = 0;
 	/* Do we want to SYNC on receive or not */
-	wc->sync = lc->sync;
+	wc->sync = (lc->sync) ? 1 : 0;
 	/* If already running, apply changes immediately */
 	if (span->flags & ZT_FLAG_RUNNING)
 		return t1xxp_startup(span);