From: Frank Mori Hess <fmhess@speakeasy.net>
Date: Sun, 22 Jul 2007 02:30:38 +0000 (+0000)
Subject: Added little sanity check for buffer overrun of gaindelay array.
X-Git-Tag: r0_7_74~45
X-Git-Url: http://git.tremily.us/?a=commitdiff_plain;h=b1532fb01675088337da15360d277e8ccc665b83;p=comedi.git

Added little sanity check for buffer overrun of gaindelay array.
---

diff --git a/comedi/drivers/rti800.c b/comedi/drivers/rti800.c
index fda8f42a..7b500a87 100644
--- a/comedi/drivers/rti800.c
+++ b/comedi/drivers/rti800.c
@@ -180,7 +180,7 @@ static int rti800_ai_insn_read(comedi_device *dev,comedi_subdevice *s,
 	int i,t;
 	int status;
 	int chan = CR_CHAN(insn->chanspec);
-	int gain = CR_RANGE(insn->chanspec);
+	unsigned gain = CR_RANGE(insn->chanspec);
 	unsigned muxgain_bits;
 	
 	inb(dev->iobase + RTI800_ADCHI);
@@ -194,7 +194,10 @@ static int rti800_ai_insn_read(comedi_device *dev,comedi_subdevice *s,
 		/* without a delay here, the RTI_OVERRUN bit
 		 * gets set, and you will have an error. */
 		if(insn->n > 0)
+		{
+			BUG_ON(gain >= sizeof(gaindelay) / sizeof(gaindelay[0]));
 			comedi_udelay(gaindelay[gain]);
+		}
 	}
 
 	for(i=0;i<insn->n;i++){