fdo-mirrors/xserver
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/xorg/xserver.git synced 2025-12-24 09:00:05 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

glx: Free DRI2 drawable reference to destroyed GLX drawable.

Browse source 
Otherwise the reference can lead to use after free in
__glXDRIinvalidateBuffers().

Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=50019

Signed-off-by: Michel Dänzer <michel.daenzer@amd.com>
Reviewed-by: Kristian Høgsberg <krh@bitplanet.net>
Signed-off-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit a2d0829531)

Signed-off-by: Julien Cristau <jcristau@debian.org>
This commit is contained in:
Michel Dänzer 2012-07-12 13:16:37 +02:00 • committed by Julien Cristau
parent 60da502963
commit 953c8df9fb
1 changed files with 6 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
glx/glxdri2.c
View file

@ -95,6 +95,7 @@ struct __GLXDRIdrawable {
int height;
__DRIbuffer buffers[MAX_DRAWABLE_BUFFERS];
int count;
XID dri2_id;
};
static void
@ -103,6 +104,8 @@ __glXDRIdrawableDestroy(__GLXdrawable * drawable)
__GLXDRIdrawable *private = (__GLXDRIdrawable *) drawable;
const __DRIcoreExtension *core = private->screen->core;
FreeResource(private->dri2_id, FALSE);
(*core->destroyDrawable) (private->driDrawable);
__glXDrawableRelease(drawable);
@ -456,8 +459,9 @@ __glXDRIscreenCreateDrawable(ClientPtr client,
private->base.waitGL = __glXDRIdrawableWaitGL;
private->base.waitX = __glXDRIdrawableWaitX;
if (DRI2CreateDrawable(client, pDraw, drawId,
__glXDRIinvalidateBuffers, private)) {
if (DRI2CreateDrawable2(client, pDraw, drawId,
__glXDRIinvalidateBuffers, private,
&private->dri2_id)) {
free(private);
return NULL;
}