fdo-mirrors/mesa
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/mesa/mesa.git synced 2026-05-05 20:28:04 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

st/mesa: fix potential use-after-free in draw_bitmap_quad

Browse source 
This is super unlikely to be freed before use, but let's fix it anyway.

setup_render_state calls set_sampler_views(take_ownership=true), which
means it takes ownership of the sampler view reference and is free to
unreference it, so we can't use sv after setup_render_state.

Fixes: feda6e9c5d - st/mesa: set take_ownership = true in set_sampler_views

Reviewed-by: Brian Paul <brianp@vmware.com>
Reviewed-by: Pierre-Eric Pelloux-Prayer <pierre-eric.pelloux-prayer@amd.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/17780>
This commit is contained in:
Marek Olšák 2022-07-24 20:36:00 -04:00 • committed by Marge Bot
parent bb860f63f6
commit cbad4adc13
1 changed files with 5 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
src/mesa/state_tracker/st_cb_bitmap.c
View file

@ -321,17 +321,17 @@ draw_bitmap_quad(struct gl_context *ctx, GLint x, GLint y, GLfloat z,
assert(height <= (GLsizei) maxSize);
}
setup_render_state(ctx, sv, color);
/* convert Z from [0,1] to [-1,-1] to match viewport Z scale/bias */
z = z * 2.0f - 1.0f;
if (sv->texture->target == PIPE_TEXTURE_RECT) {
/* use non-normalized texcoords */
sRight = (float) width;
tBot = (float) height;
}
setup_render_state(ctx, sv, color);
/* convert Z from [0,1] to [-1,-1] to match viewport Z scale/bias */
z = z * 2.0f - 1.0f;
if (!st_draw_quad(st, clip_x0, clip_y0, clip_x1, clip_y1, z,
sLeft, tBot, sRight, tTop, color, 0)) {
_mesa_error(ctx, GL_OUT_OF_MEMORY, "glBitmap");