From: Frank Mori Hess <fmhess@speakeasy.net>
Date: Tue, 24 Oct 2006 20:29:07 +0000 (+0000)
Subject: Check length of INSN_BITS instructions in core.
X-Git-Tag: r0_7_74~176
X-Git-Url: http://git.tremily.us/?a=commitdiff_plain;h=82a3831cfa98fc6d8ed3b7114584e83decbb4951;p=comedi.git

Check length of INSN_BITS instructions in core.
---

diff --git a/comedi/comedi_fops.c b/comedi/comedi_fops.c
index f61339cc..28d2506d 100644
--- a/comedi/comedi_fops.c
+++ b/comedi/comedi_fops.c
@@ -768,6 +768,11 @@ static int parse_insn(comedi_device *dev,comedi_insn *insn,lsampl_t *data,void *
 				ret=s->insn_write(dev,s,insn,data);
 				break;
 			case INSN_BITS:
+				if(insn->n != 2)
+				{
+					ret=-EINVAL;
+					break;
+				}
 				ret=s->insn_bits(dev,s,insn,data);
 				break;
 			case INSN_CONFIG: