From: Ralf <redacted>
Date: Mon, 7 Jun 2021 05:08:06 +0000 (+0200)
Subject: rigol-ds: fix use-after-free
X-Git-Url: https://sigrok.org/gitaction?a=commitdiff_plain;h=73c575cf9e4b82770d8a6f7c916903e54e9fe7e7;p=libsigrok.git

rigol-ds: fix use-after-free

This amends commit 4fad41a8a4f3 which fixed a leak but introduced the
use after free.
---

diff --git a/src/hardware/rigol-ds/protocol.c b/src/hardware/rigol-ds/protocol.c
index 6d6b28f2..05aaf113 100644
--- a/src/hardware/rigol-ds/protocol.c
+++ b/src/hardware/rigol-ds/protocol.c
@@ -267,7 +267,7 @@ static int rigol_ds_check_stop(const struct sr_dev_inst *sdi)
 /* Wait for enough data becoming available in scope output buffer */
 static int rigol_ds_block_wait(const struct sr_dev_inst *sdi)
 {
-	char *buf;
+	char *buf, c;
 	struct dev_context *devc;
 	time_t start;
 	int len, ret;
@@ -297,10 +297,11 @@ static int rigol_ds_block_wait(const struct sr_dev_inst *sdi)
 			if (sr_scpi_get_string(sdi->conn, ":WAV:STAT?", &buf) != SR_OK)
 				return SR_ERR;
 			ret = parse_int(buf + 5, &len);
+			c = buf[0];
 			g_free(buf);
 			if (ret != SR_OK)
 				return SR_ERR;
-		} while (buf[0] == 'R' && len < (1000 * 1000));
+		} while (c == 'R' && len < (1000 * 1000));
 	}
 
 	rigol_ds_set_wait_event(devc, WAIT_NONE);