diff options
| -rwxr-xr-x | zaptel.c | 11 |
1 files changed, 8 insertions, 3 deletions
@@ -2062,8 +2062,8 @@ static ssize_t zt_write(struct file *file, const char *usrbuf, size_t count, lof /* No bigger than 32k for everything per tone zone */ #define MAX_SIZE 32768 -/* No more than 30 subtones */ -#define MAX_TONES 30 +/* No more than 128 subtones */ +#define MAX_TONES 128 static int ioctl_load_zone(unsigned long data) @@ -2085,8 +2085,10 @@ ioctl_load_zone(unsigned long data) /* XXX Unnecessary XXX */ memset(next, 0, sizeof(next)); copy_from_user(&th, (struct zt_tone_def_header *)data, sizeof(th)); - if ((th.count < 0) || (th.count > MAX_TONES)) + if ((th.count < 0) || (th.count > MAX_TONES)) { + printk("Too many tones included\n"); return -EINVAL; + } space = size = sizeof(struct zt_zone) + th.count * sizeof(struct zt_tone); if ((size > MAX_SIZE) || (size < 0)) @@ -2108,6 +2110,7 @@ ioctl_load_zone(unsigned long data) if (space < sizeof(struct zt_tone)) { /* Check space for zt_tone struct */ kfree(slab); + printk("Insufficient tone zone space\n"); return -EINVAL; } if (copy_from_user(&td, (struct zt_tone_def *)data, sizeof(struct zt_tone_def))) { @@ -2120,10 +2123,12 @@ ioctl_load_zone(unsigned long data) next[x] = td.next; /* Make sure the "next" one is sane */ if ((next[x] >= th.count) || (next[x] < 0)) { + printk("Invalid 'next' pointer\n"); kfree(slab); return -EINVAL; } if (td.tone >= ZT_TONE_MAX) { + printk("Too many tones defined\n"); /* Make sure it's sane */ kfree(slab); return -EINVAL; |