Mesa (master): mesa/st: Fix derreference after free.

[Jose Fonseca]

Module: Mesa
Branch: master
Commit: 63da1aa5be4aa3e14a0456daf863c1bf10de619f
URL:    http://cgit.freedesktop.org/mesa/mesa/commit/?id=63da1aa5be4aa3e14a0456daf863c1bf10de619f

Author: José Fonseca <jfonseca at vmware.com>
Date:   Wed Apr 25 11:41:13 2012 +0100

mesa/st: Fix derreference after free.

---

 src/mesa/state_tracker/st_context.c |    8 ++++++--
 1 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/src/mesa/state_tracker/st_context.c b/src/mesa/state_tracker/st_context.c
index 84aae81..19d9da1 100644
--- a/src/mesa/state_tracker/st_context.c
+++ b/src/mesa/state_tracker/st_context.c
@@ -270,6 +270,7 @@ static void st_destroy_context_priv( struct st_context *st )
 void st_destroy_context( struct st_context *st )
 {
    struct pipe_context *pipe = st->pipe;
+   struct u_vbuf *vbuf = st->vbuf;
    struct cso_context *cso = st->cso_context;
    struct gl_context *ctx = st->ctx;
    GLuint i;
@@ -300,10 +301,13 @@ void st_destroy_context( struct st_context *st )
 
    _mesa_free_context_data(ctx);
 
+   /* This will free the st_context too, so 'st' must not be accessed
+    * afterwards. */
    st_destroy_context_priv(st);
+   st = NULL;
 
-   if (st->vbuf)
-      u_vbuf_destroy(st->vbuf);
+   if (vbuf)
+      u_vbuf_destroy(vbuf);
 
    cso_destroy_context(cso);