From b1532fb01675088337da15360d277e8ccc665b83 Mon Sep 17 00:00:00 2001 From: Frank Mori Hess Date: Sun, 22 Jul 2007 02:30:38 +0000 Subject: [PATCH] Added little sanity check for buffer overrun of gaindelay array. --- comedi/drivers/rti800.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/comedi/drivers/rti800.c b/comedi/drivers/rti800.c index fda8f42a..7b500a87 100644 --- a/comedi/drivers/rti800.c +++ b/comedi/drivers/rti800.c @@ -180,7 +180,7 @@ static int rti800_ai_insn_read(comedi_device *dev,comedi_subdevice *s, int i,t; int status; int chan = CR_CHAN(insn->chanspec); - int gain = CR_RANGE(insn->chanspec); + unsigned gain = CR_RANGE(insn->chanspec); unsigned muxgain_bits; inb(dev->iobase + RTI800_ADCHI); @@ -194,7 +194,10 @@ static int rti800_ai_insn_read(comedi_device *dev,comedi_subdevice *s, /* without a delay here, the RTI_OVERRUN bit * gets set, and you will have an error. */ if(insn->n > 0) + { + BUG_ON(gain >= sizeof(gaindelay) / sizeof(gaindelay[0])); comedi_udelay(gaindelay[gain]); + } } for(i=0;in;i++){ -- 2.26.2