shader: avoid use after free

If the shader failed to be finished, it should be removed from the
hashtable if it was already inserted. Use the goto error path in this
case to handle shader destroy and prevent potential later lookup of
invalid shader from the hashtable.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>

1 files changed, 5 insertions, 4 deletions

diff --git a/src/vrend_renderer.c b/src/vrend_renderer.c
index 77c79f2..cc0f8b8 100644
--- a/src/vrend_renderer.c
+++ b/src/vrend_renderer.c
@@ -2145,7 +2145,6 @@ static int vrend_finish_shader(struct vrend_context *ctx,
 
    r = vrend_shader_select(ctx, sel, NULL);
    if (r) {
-      vrend_destroy_shader_selector(sel);
       return EINVAL;
    }
    return 0;
@@ -2245,9 +2244,11 @@ int vrend_create_shader(struct vrend_context *ctx,
          goto error;
       }
 
-      if (vrend_finish_shader(ctx, sel, tokens))
-         new_shader = false;
-      else {
+      if (vrend_finish_shader(ctx, sel, tokens)) {
+         free(tokens);
+         ret = EINVAL;
+         goto error;
+      } else {
          free(sel->tmp_buf);
          sel->tmp_buf = NULL;
       }