Mesa (7.10): r300g: Null pointer check for buffer deref in gallium winsys
Marek Olšák
mareko at kemper.freedesktop.org
Fri Feb 11 01:37:03 UTC 2011
Module: Mesa
Branch: 7.10
Commit: 995edd4c0a05412bb9c0f733546082cad707ecca
URL: http://cgit.freedesktop.org/mesa/mesa/commit/?id=995edd4c0a05412bb9c0f733546082cad707ecca
Author: Bryce Harrington <bryce at canonical.com>
Date: Wed Jan 12 10:06:12 2011 -0800
r300g: Null pointer check for buffer deref in gallium winsys
radeon_drm_bufmgr_create_buffer_from_handle() can return NULL buffers
sometimes (seen when alt-tabbing in compiz). Avoid dereferencing the
buffer pointer in this case.
Ref.: https://bugs.launchpad.net/ubuntu/+source/mesa/+bug/691653
Also: https://bugzilla.redhat.com/show_bug.cgi?id=660143
Signed-off-by: Bryce Harrington <bryce at canonical.com>
---
src/gallium/winsys/radeon/drm/radeon_r300.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/src/gallium/winsys/radeon/drm/radeon_r300.c b/src/gallium/winsys/radeon/drm/radeon_r300.c
index 9f59b3d..7a07280 100644
--- a/src/gallium/winsys/radeon/drm/radeon_r300.c
+++ b/src/gallium/winsys/radeon/drm/radeon_r300.c
@@ -118,7 +118,7 @@ static struct r300_winsys_buffer *radeon_r300_winsys_buffer_from_handle(struct r
if (stride)
*stride = whandle->stride;
- if (size)
+ if (size && _buf)
*size = _buf->base.size;
return (struct r300_winsys_buffer*)_buf;
More information about the mesa-commit
mailing list