[Libva] [PATCH] intel-driver: Call intel_driver_terminate after i965_destroy_heap

Xiang, Haihao haihao.xiang at intel.com
Thu Aug 9 20:09:03 PDT 2012


Applied.

Thanks
Haihao

> Otherwise this leads to use-after-free of the bufmgr.
> 
> Signed-off-by: Stéphane Marchesin <marcheu at chromium.org>
> ---
>  src/i965_drv_video.c |    6 +++---
>  1 files changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/src/i965_drv_video.c b/src/i965_drv_video.c
> index 3d85248..c888afd 100644
> --- a/src/i965_drv_video.c
> +++ b/src/i965_drv_video.c
> @@ -2399,9 +2399,6 @@ i965_Terminate(VADriverContextP ctx)
>      if (i965_post_processing_terminate(ctx) == False)
>          return VA_STATUS_ERROR_UNKNOWN;
>  
> -    if (intel_driver_terminate(ctx) == False)
> -        return VA_STATUS_ERROR_UNKNOWN;
> -
>      i965_destroy_heap(&i965->buffer_heap, i965_destroy_buffer);
>      i965_destroy_heap(&i965->image_heap, i965_destroy_image);
>      i965_destroy_heap(&i965->subpic_heap, i965_destroy_subpic);
> @@ -2409,6 +2406,9 @@ i965_Terminate(VADriverContextP ctx)
>      i965_destroy_heap(&i965->context_heap, i965_destroy_context);
>      i965_destroy_heap(&i965->config_heap, i965_destroy_config);
>  
> +    if (intel_driver_terminate(ctx) == False)
> +        return VA_STATUS_ERROR_UNKNOWN;
> +
>      free(ctx->pDriverData);
>      ctx->pDriverData = NULL;
>  




More information about the Libva mailing list