Fixed array overrun for boards with more than 2 ao channels.

diff --git a/comedi/drivers/ni_mio_common.c b/comedi/drivers/ni_mio_common.c
index ded658787dcc5b78e4a55320f710411aaffbb171..51a3af7b5db7f671c891bfe6aac236cf5b8b1890 100644 (file)
--- a/comedi/drivers/ni_mio_common.c
+++ b/comedi/drivers/ni_mio_common.c
@@ -2675,6 +2675,12 @@ static int ni_E_init(comedi_device *dev,comedi_devconfig *it)
        comedi_subdevice *s;
        int bits;
 
+       if(boardtype.n_aochan > MAX_N_AO_CHAN)
+       {
+               printk("bug! boardtype.n_aochan > MAX_N_AO_CHAN\n");
+               return -EINVAL;
+       }
+       
        if(alloc_subdevices(dev, 10) < 0)
                return -ENOMEM;
 

diff --git a/comedi/drivers/ni_stc.h b/comedi/drivers/ni_stc.h
index adeb90405a31768876ef6d9e18742f0c157b3c5d..5e3a726cf887091771aeb7920ef5bb2e80e6e489 100644 (file)
--- a/comedi/drivers/ni_stc.h
+++ b/comedi/drivers/ni_stc.h
@@ -913,6 +913,8 @@ static ni_board ni_boards[];
 
 #define boardtype (*(ni_board *)dev->board_ptr)
 
+#define MAX_N_AO_CHAN 8
+
 #define NI_PRIVATE_COMMON                                      \
        unsigned short dio_output;                              \
        unsigned short dio_control;                             \
@@ -932,12 +934,12 @@ static ni_board ni_boards[];
        unsigned int changain_spec;                             \
                                                                \
        unsigned int caldac_maxdata_list[MAX_N_CALDACS];        \
-       unsigned short ao[2];                                   \
+       unsigned short ao[MAX_N_AO_CHAN];                                       \
        unsigned short caldacs[MAX_N_CALDACS];                          \
                                                                \
        volatile unsigned short ai_cmd2;        \
                                                                \
-       unsigned short ao_conf[2];                              \
+       unsigned short ao_conf[MAX_N_AO_CHAN];                          \
        unsigned short ao_mode1;                                \
        unsigned short ao_mode2;                                \
        unsigned short ao_mode3;                                \