fdo-mirrors/mesa
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/mesa/mesa.git synced 2025-12-23 06:50:11 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

mesa: Increment the list pointer while freeing instruction data

Browse source 
Since the list pointer was never incremented when a OPCODE_PIXEL_MAP
opcode was encountered, the data for the instruction would get freed
over and over and over... resulting in a crash.

Fixes gl-1.0-beginend-coverage.

Signed-off-by: Ian Romanick <ian.d.romanick@intel.com>
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=72214
Reviewed-by: Brian Paul <brianp@vmware.com>
Cc: Lu Ha <huax.lu@intel.com>
This commit is contained in:
Ian Romanick 2014-01-21 16:52:42 -08:00
parent a44554870e
commit c11d76c51a
1 changed files with 1 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
src/mesa/main/dlist.c
View file

@ -767,6 +767,7 @@ _mesa_delete_list(struct gl_context *ctx, struct gl_display_list *dlist)
break; break;
case OPCODE_PIXEL_MAP: case OPCODE_PIXEL_MAP:
free(get_pointer(&n[3])); free(get_pointer(&n[3]));
n += InstSize[n[0].opcode];
break; break;
case OPCODE_CONTINUE: case OPCODE_CONTINUE: