diff options
| author | Aaron Plattner <aplattner@nvidia.com> | 2007-08-01 14:30:03 -0700 |
|---|---|---|
| committer | Aaron Plattner <aplattner@nvidia.com> | 2007-08-06 14:22:49 -0700 |
| commit | 74feba4d77d74979a0ea478d666439ffc55001e5 (patch) | |
| tree | af3fd8b53b4703966e8acea1a8a0f81cfb159490 /fb | |
| parent | f6aa2200f2fb4f4d4bb51e67d68e86aabcac0c4b (diff) | |
Don't unwrap too early in libwfb for Composite.
Don't call fbFinishWrap until the pixman_image_t that stores the pointer is
actually freed. This prevents corruption or crashes caused by accessing a
wrapped pointer after the wrapping is torn down.
Diffstat (limited to 'fb')
| -rw-r--r-- | fb/fb.h | 1 | ||||
| -rw-r--r-- | fb/fbpict.c | 23 | ||||
| -rw-r--r-- | fb/fbtrap.c | 8 | ||||
| -rw-r--r-- | fb/wfbrename.h | 1 |
4 files changed, 16 insertions, 17 deletions
@@ -2117,6 +2117,7 @@ fbPaintWindow(WindowPtr pWin, RegionPtr pRegion, int what); pixman_image_t *image_from_pict (PicturePtr pict, Bool has_clip); +void free_pixman_pict (PicturePtr, pixman_image_t *); #endif /* _FB_H_ */ diff --git a/fb/fbpict.c b/fb/fbpict.c index 9efa0e816..4d1ad0b10 100644 --- a/fb/fbpict.c +++ b/fb/fbpict.c @@ -185,15 +185,11 @@ fbComposite (CARD8 op, pixman_image_composite (op, src, mask, dest, xSrc, ySrc, xMask, yMask, xDst, yDst, width, height); - } - - if (src) - pixman_image_unref (src); - if (mask) - pixman_image_unref (mask); - if (dest) - pixman_image_unref (dest); + + free_pixman_pict (pSrc, src); + free_pixman_pict (pMask, mask); + free_pixman_pict (pDst, dest); } void @@ -332,8 +328,6 @@ create_bits_picture (PicturePtr pict, /* Indexed table */ if (pict->pFormat->index.devPrivate) pixman_image_set_indexed (image, pict->pFormat->index.devPrivate); - - fbFinishAccess (pict->pDrawable); return image; } @@ -379,7 +373,7 @@ set_image_properties (pixman_image_t *image, PicturePtr pict) pixman_image_set_alpha_map ( image, alpha_map, pict->alphaOrigin.x, pict->alphaOrigin.y); - pixman_image_unref (alpha_map); + free_pixman_pict (pict->alphaMap, alpha_map); } pixman_image_set_component_alpha (image, pict->componentAlpha); @@ -445,6 +439,13 @@ image_from_pict (PicturePtr pict, return image; } +void +free_pixman_pict (PicturePtr pict, pixman_image_t *image) +{ + if (image && pixman_image_unref (image) && pict->pDrawable) + fbFinishAccess (pict->pDrawable); +} + Bool fbPictureInit (ScreenPtr pScreen, PictFormatPtr formats, int nformats) { diff --git a/fb/fbtrap.c b/fb/fbtrap.c index e70336cce..830603ae7 100644 --- a/fb/fbtrap.c +++ b/fb/fbtrap.c @@ -47,9 +47,7 @@ fbAddTraps (PicturePtr pPicture, pixman_add_traps (image, x_off, y_off, ntrap, (pixman_trap_t *)traps); - fbFinishAccess (pPicture->pDrawable); - - pixman_image_unref (image); + free_pixman_pict (pPicture, image); } void @@ -65,9 +63,7 @@ fbRasterizeTrapezoid (PicturePtr pPicture, pixman_rasterize_trapezoid (image, (pixman_trapezoid_t *)trap, x_off, y_off); - fbFinishAccess (pPicture->pDrawable); - - pixman_image_unref (image); + free_pixman_pict (pPicture, image); } static int diff --git a/fb/wfbrename.h b/fb/wfbrename.h index 952512ecc..5ea9092f8 100644 --- a/fb/wfbrename.h +++ b/fb/wfbrename.h @@ -188,6 +188,7 @@ #define fbWinPrivateIndex wfbWinPrivateIndex #define fbZeroLine wfbZeroLine #define fbZeroSegment wfbZeroSegment +#define free_pixman_pict wfb_free_pixman_pict #define image_from_pict wfb_image_from_pict #define xxScrPrivateIndex wfbxxScrPrivateIndex #define xxGCPrivateIndex wfbxxGCPrivateIndex |