X-Git-Url: https://sigrok.org/gitweb/?a=blobdiff_plain;f=filter.c;h=fef7005239c58608614fcea49036bfd708551b7f;hb=b7f09cf86dd57a59dc1bdece2cac9e4a176900b1;hp=5698d333f0eea57de70aa97c5ca5277a1c2f4312;hpb=488a13b110d3563194dd63e087e295a4aa114002;p=libsigrok.git

diff --git a/filter.c b/filter.c
index 5698d333..fef70052 100644
--- a/filter.c
+++ b/filter.c
@@ -20,7 +20,7 @@
 #include <stdlib.h>
 #include <stdint.h>
 #include <string.h>
-#include <sigrok.h>
+#include "sigrok.h"
 #include "sigrok-internal.h"
 
 /**
@@ -53,6 +53,9 @@
  *
  * @param in_unitsize The unit size (>= 1) of the input (data_in).
  * @param out_unitsize The unit size (>= 1) the output shall have (data_out).
+ *                     The requested unit size must be big enough to hold as
+ *                     much data as is specified by the number of enabled
+ *                     probes in 'probelist'.
  * @param probelist Pointer to a list of integers (probe numbers). The probe
  *                  numbers in this list are 1-based, i.e. the first probe
  *                  is expected to be numbered 1 (not 0!). Must not be NULL.
@@ -98,15 +101,27 @@ int sr_filter_probes(int in_unitsize, int out_unitsize, const int *probelist,
 		return SR_ERR_ARG;
 	}
 
-	if (!(*data_out = g_try_malloc(length_in))) {
-		sr_err("filter: %s: data_out malloc failed", __func__);
-		return SR_ERR_MALLOC;
+	if (!length_out) {
+		sr_err("filter: %s: length_out was NULL", __func__);
+		return SR_ERR_ARG;
 	}
 
 	num_enabled_probes = 0;
 	for (i = 0; probelist[i]; i++)
 		num_enabled_probes++;
 
+	/* Are there more probes than the target unit size supports? */
+	if (num_enabled_probes > out_unitsize * 8) {
+		sr_err("filter: %s: too many probes (%d) for the target unit "
+		       "size (%d)", num_enabled_probes, out_unitsize, __func__);
+		return SR_ERR_ARG;
+	}
+
+	if (!(*data_out = g_try_malloc(length_in))) {
+		sr_err("filter: %s: data_out malloc failed", __func__);
+		return SR_ERR_MALLOC;
+	}
+
 	if (num_enabled_probes == in_unitsize * 8) {
 		/* All probes are used -- no need to compress anything. */
 		memcpy(*data_out, data_in, length_in);