comedi/drivers.c: handle insn->n == 0 in insn_rw_emulate_bits

A recent change to do_insnlist_ioctl() and do_insn_ioctl() to handle
arbitrary limits on means that the 'data' pointer will now be NULL when
insn->n == 0.  Need to check insn->n is non-zero before accessing *data.

Signed-off-by: Ian Abbott <abbotti@mev.co.uk>

diff --git a/comedi/drivers.c b/comedi/drivers.c
index 66bd91cf20adc2b0bd54d35670276f052b3fb449..330426720294aa1877227b012a235d7441162e0b 100644 (file)
--- a/comedi/drivers.c
+++ b/comedi/drivers.c
@@ -350,11 +350,17 @@ static int insn_rw_emulate_bits(comedi_device * dev, comedi_subdevice * s,
        comedi_insn new_insn;
        int ret;
        static const unsigned channels_per_bitfield = 32;
-
        unsigned chan = CR_CHAN(insn->chanspec);
        const unsigned base_bitfield_channel =
                (chan < channels_per_bitfield) ? 0 : chan;
        lsampl_t new_data[2];
+
+       if ((insn->insn == INSN_WRITE) && !(s->subdev_flags & SDF_WRITABLE))
+               return -EINVAL;
+
+       if (insn->n == 0) 
+               return 0;
+
        memset(new_data, 0, sizeof(new_data));
        memset(&new_insn, 0, sizeof(new_insn));
        new_insn.insn = INSN_BITS;
@@ -364,8 +370,6 @@ static int insn_rw_emulate_bits(comedi_device * dev, comedi_subdevice * s,
        new_insn.subdev = insn->subdev;
 
        if (insn->insn == INSN_WRITE) {
-               if (!(s->subdev_flags & SDF_WRITABLE))
-                       return -EINVAL;
                new_data[0] = 1 << (chan - base_bitfield_channel);      /* mask */
                new_data[1] = data[0] ? (1 << (chan - base_bitfield_channel)) : 0;      /* bits */
        }