fdo-mirrors/mesa
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/mesa/mesa.git synced 2026-05-08 22:08:26 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

st/mesa: fix context use-after-free problem in st_renderbuffer_delete()

Browse source 
The use-after-free happened when the renderbuffer was shared by multiple
contexts and we tried to delete the renderbuffer using a context which
was previously deleted.

Note: this is a candidate for the stable branches.

Reviewed-by: Jose Fonseca <jfonseca@vmware.com>
(cherry picked from commit 4cedb65a43)
This commit is contained in:
Brian Paul 2012-11-30 10:11:54 -07:00 • committed by Andreas Boll
parent 9d4ab9a663
commit 527b3b8555
1 changed files with 5 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
src/mesa/state_tracker/st_cb_fbo.c
View file

@ -228,8 +228,10 @@ static void
st_renderbuffer_delete(struct gl_context *ctx, struct gl_renderbuffer *rb)
{
struct st_renderbuffer *strb = st_renderbuffer(rb);
ASSERT(strb);
pipe_surface_reference(&strb->surface, NULL);
struct st_context *st = st_context(ctx);
struct pipe_context *pipe = st->pipe;
pipe_surface_release(pipe, &strb->surface);
pipe_resource_reference(&strb->texture, NULL);
free(strb->data);
_mesa_delete_renderbuffer(ctx, rb);
@ -434,7 +436,7 @@ st_render_texture(struct gl_context *ctx,
pipe_resource_reference( &strb->texture, pt );
pipe_surface_reference(&strb->surface, NULL);
pipe_surface_release(pipe, &strb->surface);
assert(strb->rtt_level <= strb->texture->last_level);