diff --git a/drivers/isdn/eicon/common.c b/drivers/isdn/eicon/common.c index 4f1cf167..1305cfac 100644 --- a/drivers/isdn/eicon/common.c +++ b/drivers/isdn/eicon/common.c @@ -81,10 +81,20 @@ card_t DivasCards[MAX_CARDS]; dia_config_t *DivasConfig(card_t *, dia_config_t *); static -DESCRIPTOR DIDD_Table[16]; +DESCRIPTOR DIDD_Table[32]; void DIVA_DIDD_Read( DESCRIPTOR *table, int tablelength ) { + if (tablelength > sizeof(DIDD_Table)) + tablelength = sizeof(DIDD_Table); + + bzero(table, tablelength); + + if(tablelength % sizeof(DESCRIPTOR)) { + tablelength /= sizeof(DESCRIPTOR); + tablelength *= sizeof(DESCRIPTOR); + } + if (tablelength > 0) bcopy((caddr_t)DIDD_Table, (caddr_t)table, tablelength); @@ -105,7 +115,7 @@ void DIVA_DIDD_Write(DESCRIPTOR *table, int tablelength) static void init_idi_tab(void) { - DESCRIPTOR d[16]; + DESCRIPTOR d[32]; bzero(d, sizeof(d)); @@ -654,7 +664,7 @@ int DivasCardLoad(dia_load_t *load) static int idi_register(card_t *card, byte channels) { - DESCRIPTOR d[16]; + DESCRIPTOR d[32]; int length, num_entities; DPRINTF(("divas: registering card with IDI")); diff --git a/drivers/isdn/eicon/eicon_mod.c b/drivers/isdn/eicon/eicon_mod.c index 213fad80..1bf7ca4c 100644 --- a/drivers/isdn/eicon/eicon_mod.c +++ b/drivers/isdn/eicon/eicon_mod.c @@ -78,7 +78,7 @@ ulong DebugVar; spinlock_t eicon_lock; -DESCRIPTOR idi_d[16]; +DESCRIPTOR idi_d[32]; /* Parameters to be set by insmod */ #ifdef CONFIG_ISDN_DRV_EICON_ISA @@ -400,9 +400,13 @@ eicon_command(eicon_card * card, isdn_ctrl * c) if (((c->arg - EICON_IOCTL_DIA_OFFSET)==DIA_IOCTL_START) && (!ret)) { if (card->type != EICON_CTYPE_MAESTRAQ) { DIVA_DIDD_Read(idi_d, sizeof(idi_d)); - for(idi_length = 0; idi_length < 16; idi_length++) + for(idi_length = 0; idi_length < 32; idi_length++) { if (idi_d[idi_length].type == 0) break; - if (idi_length < 1) break; + } + if ((idi_length < 1) || (idi_length >= 32)) { + eicon_log(card, 1, "eicon: invalid idi table length.\n"); + break; + } card->d = &idi_d[idi_length - 1]; card->flags |= EICON_FLAGS_LOADED; card->flags |= EICON_FLAGS_RUNNING; @@ -423,9 +427,12 @@ eicon_command(eicon_card * card, isdn_ctrl * c) } else { int i; DIVA_DIDD_Read(idi_d, sizeof(idi_d)); - for(idi_length = 0; idi_length < 16; idi_length++) + for(idi_length = 0; idi_length < 32; idi_length++) if (idi_d[idi_length].type == 0) break; - if (idi_length < 1) break; + if ((idi_length < 1) || (idi_length >= 32)) { + eicon_log(card, 1, "eicon: invalid idi table length.\n"); + break; + } for(i = 3; i >= 0; i--) { if (!(card = eicon_findnpcicard(dstart.card_id - i))) return -EINVAL;