diff options
| author | Dave Airlie <airlied@redhat.com> | 2012-08-03 16:41:45 +1000 |
|---|---|---|
| committer | Dave Airlie <airlied@redhat.com> | 2012-08-07 08:25:06 +1000 |
| commit | 1a465fef9bc21142eecca3999f0761a3c0501a09 (patch) | |
| tree | 3aabe2134e1b23a24ee993b3d7cd30962600b98a /dix/pixmap.c | |
| parent | afa53fe7cffd430cf11f25ca818cb955a78c0c1c (diff) | |
pixmap: have slave pixmap take a reference on master pixmap
Since the free routines free the master pixmap then the slave, we should
be taking a reference when we bind them together.
Fixes a use-after-free when resizing a primed gears.
Signed-off-by: Dave Airlie <airlied@redhat.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Diffstat (limited to 'dix/pixmap.c')
| -rw-r--r-- | dix/pixmap.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/dix/pixmap.c b/dix/pixmap.c index 9163e99eb..241881262 100644 --- a/dix/pixmap.c +++ b/dix/pixmap.c @@ -148,6 +148,10 @@ PixmapPtr PixmapShareToSlave(PixmapPtr pixmap, ScreenPtr slave) pixmap->drawable.height, depth, 0, pixmap->devKind, NULL); + /* have the slave pixmap take a reference on the master pixmap + later we destroy them both at the same time */ + pixmap->refcnt++; + spix->master_pixmap = pixmap; ret = slave->SetSharedPixmapBacking(spix, handle); |