From: Florian Schmidt <redacted>
Date: Wed, 8 Apr 2020 10:24:48 +0000 (+0200)
Subject: scpi-pps: fixed out-of-bounds array access...
X-Git-Url: http://sigrok.org/gitweb/?a=commitdiff_plain;h=8f3c77db26dece82109b386ad5ba7ea344b1ec8f;hp=f0aec556058d3121585211d8526a0b4cc617684a;p=libsigrok.git

scpi-pps: fixed out-of-bounds array access...

when accessing devc->device->channels in config_list().
this array has to be accessed via the "hw_output_idx"

This fixes bug #1533.
---

diff --git a/src/hardware/scpi-pps/api.c b/src/hardware/scpi-pps/api.c
index 3d02b2cb..8fa49b66 100644
--- a/src/hardware/scpi-pps/api.c
+++ b/src/hardware/scpi-pps/api.c
@@ -674,6 +674,7 @@ static int config_list(uint32_t key, GVariant **data,
 {
 	struct dev_context *devc;
 	struct sr_channel *ch;
+	struct pps_channel *pch;
 	const struct channel_spec *ch_spec;
 	int i;
 	const char *s[16];
@@ -721,9 +722,10 @@ static int config_list(uint32_t key, GVariant **data,
 		 * specification for use in series or parallel mode.
 		 */
 		ch = cg->channels->data;
+		pch = ch->priv;
 		if (!devc || !devc->device)
 			return SR_ERR_ARG;
-		ch_spec = &(devc->device->channels[ch->index]);
+		ch_spec = &(devc->device->channels[pch->hw_output_idx]);
 
 		switch (key) {
 		case SR_CONF_DEVICE_OPTIONS: