From 3740d12ba077084afd77ddda894864daed04c91c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Ondra=C4=8Dka?= Date: Mon, 4 May 2026 15:36:20 +0200 Subject: [PATCH] r300: fix use-after-free of remap_table in rc_remove_unused_constants When externals were not remapped, free(s->remap_table) ran before rc_constants_print. Print the constants first, then free. Part-of: --- src/gallium/drivers/r300/compiler/radeon_remove_constants.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/gallium/drivers/r300/compiler/radeon_remove_constants.c b/src/gallium/drivers/r300/compiler/radeon_remove_constants.c index ceb763d52fa..e55730e3d43 100644 --- a/src/gallium/drivers/r300/compiler/radeon_remove_constants.c +++ b/src/gallium/drivers/r300/compiler/radeon_remove_constants.c @@ -378,6 +378,9 @@ rc_remove_unused_constants(struct radeon_compiler *c, void *user) rc_constants_destroy(&c->Program.Constants); c->Program.Constants = s->new_constants; + if (c->Debug & RC_DBG_LOG) + rc_constants_print(&c->Program.Constants, s->remap_table); + if (s->are_externals_remapped) { *out_remap_table = s->remap_table; } else { @@ -387,7 +390,4 @@ rc_remove_unused_constants(struct radeon_compiler *c, void *user) free(s->inv_remap_table); free(s->is_used_as_vector); - - if (c->Debug & RC_DBG_LOG) - rc_constants_print(&c->Program.Constants, s->remap_table); }