Added little sanity check for buffer overrun of gaindelay array.

diff --git a/comedi/drivers/rti800.c b/comedi/drivers/rti800.c
index fda8f42ab5f8ebf194cb3be45c3875093265afd4..7b500a87b5e10914aa875fa282391c2a26071013 100644 (file)
--- a/comedi/drivers/rti800.c
+++ b/comedi/drivers/rti800.c
@@ -180,7 +180,7 @@ static int rti800_ai_insn_read(comedi_device *dev,comedi_subdevice *s,
        int i,t;
        int status;
        int chan = CR_CHAN(insn->chanspec);
-       int gain = CR_RANGE(insn->chanspec);
+       unsigned gain = CR_RANGE(insn->chanspec);
        unsigned muxgain_bits;
        
        inb(dev->iobase + RTI800_ADCHI);
@@ -194,7 +194,10 @@ static int rti800_ai_insn_read(comedi_device *dev,comedi_subdevice *s,
                /* without a delay here, the RTI_OVERRUN bit
                 * gets set, and you will have an error. */
                if(insn->n > 0)
+               {
+                       BUG_ON(gain >= sizeof(gaindelay) / sizeof(gaindelay[0]));
                        comedi_udelay(gaindelay[gain]);
+               }
        }
 
        for(i=0;i<insn->n;i++){