scpi-pps: fixed out-of-bounds array access...

when accessing devc->device->channels in config_list().
this array has to be accessed via the "hw_output_idx"

This fixes bug #1533.

diff --git a/src/hardware/scpi-pps/api.c b/src/hardware/scpi-pps/api.c
index 3d02b2cb040b00f2454471e5a01729447b3741d4..8fa49b66a2b409211f34975eb8645f23d6eaebcf 100644 (file)
--- a/src/hardware/scpi-pps/api.c
+++ b/src/hardware/scpi-pps/api.c
@@ -674,6 +674,7 @@ static int config_list(uint32_t key, GVariant **data,
 {
        struct dev_context *devc;
        struct sr_channel *ch;
+       struct pps_channel *pch;
        const struct channel_spec *ch_spec;
        int i;
        const char *s[16];
@@ -721,9 +722,10 @@ static int config_list(uint32_t key, GVariant **data,
                 * specification for use in series or parallel mode.
                 */
                ch = cg->channels->data;
+               pch = ch->priv;
                if (!devc || !devc->device)
                        return SR_ERR_ARG;
-               ch_spec = &(devc->device->channels[ch->index]);
+               ch_spec = &(devc->device->channels[pch->hw_output_idx]);
 
                switch (key) {
                case SR_CONF_DEVICE_OPTIONS: