From e66e3069a210598a952fdcab793847f9ce045be5 Mon Sep 17 00:00:00 2001 From: tzafrir Date: Tue, 25 Nov 2008 21:01:04 +0000 Subject: Fix handling of an invalid timing (sync) parameter in DAHDI_SPANCONFIG. Fixing issue #13954 in zaptel 1.4 git-svn-id: http://svn.digium.com/svn/zaptel/branches/1.4@4588 5390a7c7-147a-4af0-8ec9-7488f05a26cb --- kernel/tor2.c | 5 +++++ kernel/torisa.c | 5 +++++ kernel/wct1xxp.c | 2 +- kernel/wcte11xp.c | 2 +- 4 files changed, 12 insertions(+), 2 deletions(-) diff --git a/kernel/tor2.c b/kernel/tor2.c index e426ad2..6a03a41 100644 --- a/kernel/tor2.c +++ b/kernel/tor2.c @@ -203,6 +203,11 @@ static int tor2_spanconfig(struct zt_span *span, struct zt_lineconfig *lc) if (debug) printk("Tor2: Configuring span %d\n", span->spanno); + if ((lc->sync < 0) || (lc->sync >= SPANS_PER_CARD)) { + printk(KERN_WARNING "%s %d: invalid span timing value %d.\n", + THIS_MODULE->name, span->spanno, lc->sync); + return -EINVAL; + } span->syncsrc = p->tor->syncsrc; /* remove this span number from the current sync sources, if there */ diff --git a/kernel/torisa.c b/kernel/torisa.c index 4f02147..f0a8909 100644 --- a/kernel/torisa.c +++ b/kernel/torisa.c @@ -603,6 +603,11 @@ static int torisa_spanconfig(struct zt_span *span, struct zt_lineconfig *lc) if (debug) printk("TorISA: Configuring span %d\n", span->spanno); + if ((lc->sync < 0) || (lc->sync >= 2)) { + printk(KERN_WARNING "%s %d: invalid span timing value %d.\n", + THIS_MODULE->name, span->spanno, lc->sync); + return -EINVAL; + } span->syncsrc = syncsrc; /* remove this span number from the current sync sources, if there */ diff --git a/kernel/wct1xxp.c b/kernel/wct1xxp.c index aee95c1..f726040 100644 --- a/kernel/wct1xxp.c +++ b/kernel/wct1xxp.c @@ -739,7 +739,7 @@ static int t1xxp_spanconfig(struct zt_span *span, struct zt_lineconfig *lc) struct t1xxp *wc = span->pvt; /* Do we want to SYNC on receive or not */ - wc->sync = lc->sync; + wc->sync = (lc->sync) ? 1 : 0; /* If already running, apply changes immediately */ if (span->flags & ZT_FLAG_RUNNING) return t1xxp_startup(span); diff --git a/kernel/wcte11xp.c b/kernel/wcte11xp.c index 1d5bd51..a50fd25 100644 --- a/kernel/wcte11xp.c +++ b/kernel/wcte11xp.c @@ -947,7 +947,7 @@ static int t1xxp_spanconfig(struct zt_span *span, struct zt_lineconfig *lc) struct t1 *wc = span->pvt; /* Do we want to SYNC on receive or not */ - wc->sync = lc->sync; + wc->sync = (lc->sync) ? 1 : 0; /* If already running, apply changes immediately */ if (span->flags & ZT_FLAG_RUNNING) return t1xxp_startup(span); -- cgit v1.2.3