Check length of INSN_BITS instructions in core.

diff --git a/comedi/comedi_fops.c b/comedi/comedi_fops.c
index f61339cc72fb8a4b7843729e478b04c1cca03615..28d2506dcda7d2bfa8c89374f6984d8fc59b7dda 100644 (file)
--- a/comedi/comedi_fops.c
+++ b/comedi/comedi_fops.c
@@ -768,6 +768,11 @@ static int parse_insn(comedi_device *dev,comedi_insn *insn,lsampl_t *data,void *
                                ret=s->insn_write(dev,s,insn,data);
                                break;
                        case INSN_BITS:
+                               if(insn->n != 2)
+                               {
+                                       ret=-EINVAL;
+                                       break;
+                               }
                                ret=s->insn_bits(dev,s,insn,data);
                                break;
                        case INSN_CONFIG: