diff options
| author | Michel Dänzer <michel.daenzer@amd.com> | 2012-07-12 13:16:37 +0200 |
|---|---|---|
| committer | Keith Packard <keithp@keithp.com> | 2012-07-12 15:08:55 -0700 |
| commit | a2d0829531249e24dbca25fc20ed30a2bb2d8ed8 (patch) | |
| tree | a64d8204c6531c3d047bee7256e31e2928e03ff8 /glx/glxdri2.c | |
| parent | 8a87acc9e57be740e3bd252567622246051a0723 (diff) | |
glx: Free DRI2 drawable reference to destroyed GLX drawable.
Otherwise the reference can lead to use after free in
__glXDRIinvalidateBuffers().
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=50019
Signed-off-by: Michel Dänzer <michel.daenzer@amd.com>
Reviewed-by: Kristian Høgsberg <krh@bitplanet.net>
Signed-off-by: Keith Packard <keithp@keithp.com>
Diffstat (limited to 'glx/glxdri2.c')
| -rw-r--r-- | glx/glxdri2.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/glx/glxdri2.c b/glx/glxdri2.c index 909de706a..be5afbce4 100644 --- a/glx/glxdri2.c +++ b/glx/glxdri2.c @@ -106,6 +106,7 @@ struct __GLXDRIdrawable { int height; __DRIbuffer buffers[MAX_DRAWABLE_BUFFERS]; int count; + XID dri2_id; }; static void @@ -114,6 +115,8 @@ __glXDRIdrawableDestroy(__GLXdrawable * drawable) __GLXDRIdrawable *private = (__GLXDRIdrawable *) drawable; const __DRIcoreExtension *core = private->screen->core; + FreeResource(private->dri2_id, FALSE); + (*core->destroyDrawable) (private->driDrawable); __glXDrawableRelease(drawable); @@ -670,8 +673,9 @@ __glXDRIscreenCreateDrawable(ClientPtr client, private->base.waitGL = __glXDRIdrawableWaitGL; private->base.waitX = __glXDRIdrawableWaitX; - if (DRI2CreateDrawable(client, pDraw, drawId, - __glXDRIinvalidateBuffers, private)) { + if (DRI2CreateDrawable2(client, pDraw, drawId, + __glXDRIinvalidateBuffers, private, + &private->dri2_id)) { free(private); return NULL; } |