Mesa (master): sw/xlib: NULL-out pointers after freeing image data

[Brian Paul]

Module: Mesa
Branch: master
Commit: e5d0c730d124aa5ed380ed29162ea76329898844
URL:    http://cgit.freedesktop.org/mesa/mesa/commit/?id=e5d0c730d124aa5ed380ed29162ea76329898844

Author: Brian Paul <brianp at vmware.com>
Date:   Mon May 24 16:20:30 2010 -0600

sw/xlib: NULL-out pointers after freeing image data

This fixes a double-free() error when not using a shared memory XImage.
The XDestroyImage() function frees the ximage->data buffer if non-NULL.
If we free it ourselves, we also need to NULL-out the pointer.

---

 src/gallium/winsys/sw/xlib/xlib_sw_winsys.c |    8 +++++++-
 1 files changed, 7 insertions(+), 1 deletions(-)

diff --git a/src/gallium/winsys/sw/xlib/xlib_sw_winsys.c b/src/gallium/winsys/sw/xlib/xlib_sw_winsys.c
index 56d2df8..3d702ae 100644
--- a/src/gallium/winsys/sw/xlib/xlib_sw_winsys.c
+++ b/src/gallium/winsys/sw/xlib/xlib_sw_winsys.c
@@ -255,11 +255,17 @@ xm_displaytarget_destroy(struct sw_winsys *ws,
       }
       else {
          FREE(xm_dt->data);
+         if (xm_dt->tempImage->data == xm_dt->data) {
+            xm_dt->tempImage->data = NULL;
+         }
+         xm_dt->data = NULL;
       }
    }
 
-   if (xm_dt->tempImage)
+   if (xm_dt->tempImage) {
       XDestroyImage(xm_dt->tempImage);
+      xm_dt->tempImage = NULL;
+   }
 
    if (xm_dt->gc)
       XFreeGC(xm_dt->display, xm_dt->gc);