[zaptel-commits] russell: branch 1.4 r1507 - /branches/1.4/wct4xxp/base.c

[zaptel-commits at lists.digium.com]

Author: russell
Date: Tue Oct 17 11:40:45 2006
New Revision: 1507

URL: http://svn.digium.com/view/zaptel?rev=1507&view=rev
Log:
Set the readbuf size to be the same size of the variable, readsize.  This buffer
was 31 bytes, while the readsize could be 32 bytes, causing a read into invalid
memory.  (issue #8155, araasch)

Modified:
    branches/1.4/wct4xxp/base.c

Modified: branches/1.4/wct4xxp/base.c
URL: http://svn.digium.com/view/zaptel/branches/1.4/wct4xxp/base.c?rev=1507&r1=1506&r2=1507&view=diff
==============================================================================
--- branches/1.4/wct4xxp/base.c (original)
+++ branches/1.4/wct4xxp/base.c Tue Oct 17 11:40:45 2006
@@ -2637,7 +2637,7 @@
 	if (readsize > 0) {
 		struct zt_chan *sigchan = ts->sigchan;
 		int i;
-		unsigned char readbuf[FRMR_RBCL_MAX_SIZE];
+		unsigned char readbuf[readsize];
 
 		if (debug & DEBUG_FRAMER) printk("Framer %d: Got RPF/RME! readsize is %d\n", sigchan->span->offset, readsize);