From 82a3831cfa98fc6d8ed3b7114584e83decbb4951 Mon Sep 17 00:00:00 2001
From: Frank Mori Hess <fmhess@speakeasy.net>
Date: Tue, 24 Oct 2006 20:29:07 +0000
Subject: [PATCH] Check length of INSN_BITS instructions in core.

---
 comedi/comedi_fops.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/comedi/comedi_fops.c b/comedi/comedi_fops.c
index f61339cc..28d2506d 100644
--- a/comedi/comedi_fops.c
+++ b/comedi/comedi_fops.c
@@ -768,6 +768,11 @@ static int parse_insn(comedi_device *dev,comedi_insn *insn,lsampl_t *data,void *
 				ret=s->insn_write(dev,s,insn,data);
 				break;
 			case INSN_BITS:
+				if(insn->n != 2)
+				{
+					ret=-EINVAL;
+					break;
+				}
 				ret=s->insn_bits(dev,s,insn,data);
 				break;
 			case INSN_CONFIG:
-- 
2.26.2