From 3b20fe39aff9bf37dbc99b10041203d614e7d06b Mon Sep 17 00:00:00 2001 From: Russ Meyerriecks Date: Mon, 15 Aug 2011 21:57:49 +0000 Subject: [PATCH] wct4xxp: Bug in timing cable with different span density cards The logic loops through the static cards[] array to determine timing, but the subloop was based off the current card's numspans member. This could cause a null dereference in the case where two cards of different span densities were connected via timing cables. Reported-by: Doug Bailey Signed-off-by: Russ Meyerriecks git-svn-id: http://svn.asterisk.org/svn/dahdi/linux/trunk@10140 a0bf4364-ded3-4de4-8d8a-66a801d63aff --- drivers/dahdi/wct4xxp/base.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/dahdi/wct4xxp/base.c b/drivers/dahdi/wct4xxp/base.c index 7917aea..f1c2bed 100644 --- a/drivers/dahdi/wct4xxp/base.c +++ b/drivers/dahdi/wct4xxp/base.c @@ -2384,7 +2384,7 @@ static int __t4_findsync(struct t4 *wc) while (p < 8) { nonzero = 0; for (x=0;cards[x];x++) { - for (i = 0; i < wc->numspans; i++) { + for (i = 0; i < cards[x]->numspans; i++) { if (cards[x]->tspans[i]->syncpos) { nonzero = 1; if ((cards[x]->tspans[i]->syncpos == p) &&