diff options
| author | Michel Dänzer <michel.daenzer@amd.com> | 2012-07-12 13:16:37 +0200 |
|---|---|---|
| committer | Julien Cristau <jcristau@debian.org> | 2012-07-30 19:26:20 +0200 |
| commit | 953c8df9fb7515f70ee6dac7e210e909d26e1490 (patch) | |
| tree | 3d3f5a42595fc7107b2f3be37ec00c3ea029531a | |
| parent | 60da5029634ca6258e4e2924ed204096437a0503 (diff) | |
glx: Free DRI2 drawable reference to destroyed GLX drawable.
Otherwise the reference can lead to use after free in
__glXDRIinvalidateBuffers().
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=50019
Signed-off-by: Michel Dänzer <michel.daenzer@amd.com>
Reviewed-by: Kristian Høgsberg <krh@bitplanet.net>
Signed-off-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit a2d0829531249e24dbca25fc20ed30a2bb2d8ed8)
Signed-off-by: Julien Cristau <jcristau@debian.org>
| -rw-r--r-- | glx/glxdri2.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/glx/glxdri2.c b/glx/glxdri2.c index aa38295fa..29af190d6 100644 --- a/glx/glxdri2.c +++ b/glx/glxdri2.c @@ -95,6 +95,7 @@ struct __GLXDRIdrawable { int height; __DRIbuffer buffers[MAX_DRAWABLE_BUFFERS]; int count; + XID dri2_id; }; static void @@ -103,6 +104,8 @@ __glXDRIdrawableDestroy(__GLXdrawable * drawable) __GLXDRIdrawable *private = (__GLXDRIdrawable *) drawable; const __DRIcoreExtension *core = private->screen->core; + FreeResource(private->dri2_id, FALSE); + (*core->destroyDrawable) (private->driDrawable); __glXDrawableRelease(drawable); @@ -456,8 +459,9 @@ __glXDRIscreenCreateDrawable(ClientPtr client, private->base.waitGL = __glXDRIdrawableWaitGL; private->base.waitX = __glXDRIdrawableWaitX; - if (DRI2CreateDrawable(client, pDraw, drawId, - __glXDRIinvalidateBuffers, private)) { + if (DRI2CreateDrawable2(client, pDraw, drawId, + __glXDRIinvalidateBuffers, private, + &private->dri2_id)) { free(private); return NULL; } |