additional checks for getrange ioctl

diff --git a/comedi/range.c b/comedi/range.c
index eba0aed1cbe545744c62b53de910889896e04b45..3c1fc09d4c4625a2e6069e7b0e026cf3dce37142 100644 (file)
--- a/comedi/range.c
+++ b/comedi/range.c
@@ -76,6 +76,12 @@ int do_rangeinfo_ioctl(comedi_device *dev,comedi_rangeinfo *arg)
                return -EINVAL;
        }
 
+       if( (it.range_type&0xffff) != lr->length){
+               DPRINTK("wrong length %d should be %d (0x%08lx)\n",
+                       it.range_type&0xffff,lr->length,it.range_type);
+               return -EINVAL;
+       }
+
        if(copy_to_user(it.range_ptr,lr->range,
                sizeof(comedi_krange)*lr->length))
                return -EFAULT;