diff options
| author | russell <russell@5390a7c7-147a-4af0-8ec9-7488f05a26cb> | 2006-10-17 16:40:45 +0000 |
|---|---|---|
| committer | russell <russell@5390a7c7-147a-4af0-8ec9-7488f05a26cb> | 2006-10-17 16:40:45 +0000 |
| commit | afdd915b3440aae1df6840c38aa356ffb616e135 (patch) | |
| tree | a352f3b8def7cfe6795217404aafd131c17145ac /wct4xxp/base.c | |
| parent | a4a7d130ab140d409e3594e0adb7e2b6c77f7a1b (diff) | |
Set the readbuf size to be the same size of the variable, readsize. This buffer
was 31 bytes, while the readsize could be 32 bytes, causing a read into invalid
memory. (issue #8155, araasch)
git-svn-id: http://svn.digium.com/svn/zaptel/branches/1.4@1507 5390a7c7-147a-4af0-8ec9-7488f05a26cb
Diffstat (limited to 'wct4xxp/base.c')
| -rw-r--r-- | wct4xxp/base.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/wct4xxp/base.c b/wct4xxp/base.c index b26307e..72afb05 100644 --- a/wct4xxp/base.c +++ b/wct4xxp/base.c @@ -2637,7 +2637,7 @@ static inline void __t4_framer_interrupt(struct t4 *wc, int span) if (readsize > 0) { struct zt_chan *sigchan = ts->sigchan; int i; - unsigned char readbuf[FRMR_RBCL_MAX_SIZE]; + unsigned char readbuf[readsize]; if (debug & DEBUG_FRAMER) printk("Framer %d: Got RPF/RME! readsize is %d\n", sigchan->span->offset, readsize); |