Mesa (7.9): r300g: Null pointer check for buffer deref in gallium winsys

[Marek Olšák]

Module: Mesa
Branch: 7.9
Commit: da623c9c44bd71965ca62236485e64cb3c90604d
URL:    http://cgit.freedesktop.org/mesa/mesa/commit/?id=da623c9c44bd71965ca62236485e64cb3c90604d

Author: Bryce Harrington <bryce at canonical.com>
Date:   Wed Jan 12 10:06:12 2011 -0800

r300g: Null pointer check for buffer deref in gallium winsys

radeon_drm_bufmgr_create_buffer_from_handle() can return NULL buffers
sometimes (seen when alt-tabbing in compiz).  Avoid dereferencing the
buffer pointer in this case.

Ref.: https://bugs.launchpad.net/ubuntu/+source/mesa/+bug/691653
Also: https://bugzilla.redhat.com/show_bug.cgi?id=660143

Signed-off-by: Bryce Harrington <bryce at canonical.com>

---

 src/gallium/winsys/radeon/drm/radeon_r300.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/src/gallium/winsys/radeon/drm/radeon_r300.c b/src/gallium/winsys/radeon/drm/radeon_r300.c
index 420522f..2d1bd1e 100644
--- a/src/gallium/winsys/radeon/drm/radeon_r300.c
+++ b/src/gallium/winsys/radeon/drm/radeon_r300.c
@@ -119,7 +119,7 @@ static struct r300_winsys_buffer *radeon_r300_winsys_buffer_from_handle(struct r
 
     if (stride)
         *stride = whandle->stride;
-    if (size)
+    if (size && _buf)
         *size = _buf->base.size;
 
     return radeon_libdrm_winsys_buffer(_buf);