From: Ian Abbott <abbotti@mev.co.uk>
Date: Fri, 9 Nov 2007 13:50:14 +0000 (+0000)
Subject: For COMEDI_CMD ioctl, check chanlist_len > 0.
X-Git-Tag: v0_7_76~80
X-Git-Url: http://git.tremily.us/?a=commitdiff_plain;h=1eb3e856ef2df766dcd00c40ec6f4e32fc1079b9;p=comedi.git

For COMEDI_CMD ioctl, check chanlist_len > 0.
---

diff --git a/comedi/comedi_fops.c b/comedi/comedi_fops.c
index ecea4b4a..2513b014 100644
--- a/comedi/comedi_fops.c
+++ b/comedi/comedi_fops.c
@@ -942,12 +942,20 @@ static int do_cmd_ioctl(comedi_device * dev, void *arg, void *file)
 
 	/* make sure channel/gain list isn't too long */
 	if (user_cmd.chanlist_len > s->len_chanlist) {
-		DPRINTK("channel/gain list too long %d > %d\n",
+		DPRINTK("channel/gain list too long %u > %d\n",
 			user_cmd.chanlist_len, s->len_chanlist);
 		ret = -EINVAL;
 		goto cleanup;
 	}
 
+	/* make sure channel/gain list isn't too short */
+	if (user_cmd.chanlist_len < 1) {
+		DPRINTK("channel/gain list too short %u < 1\n",
+			user_cmd.chanlist_len);
+		ret = -EINVAL;
+		goto cleanup;
+	}
+
 	if (async->cmd.chanlist)
 		kfree(async->cmd.chanlist);
 	async->cmd = user_cmd;