Mesa (master): st/mesa: fix context use-after-free problem in st_renderbuffer_delete()
Brian Paul
brianp at kemper.freedesktop.org
Fri Nov 30 20:38:00 UTC 2012
Module: Mesa
Branch: master
Commit: 4cedb65a43ae81c7ac71e631c854b7404dd2b61b
URL: http://cgit.freedesktop.org/mesa/mesa/commit/?id=4cedb65a43ae81c7ac71e631c854b7404dd2b61b
Author: Brian Paul <brianp at vmware.com>
Date: Fri Nov 30 10:11:54 2012 -0700
st/mesa: fix context use-after-free problem in st_renderbuffer_delete()
The use-after-free happened when the renderbuffer was shared by multiple
contexts and we tried to delete the renderbuffer using a context which
was previously deleted.
Note: this is a candidate for the stable branches.
Reviewed-by: Jose Fonseca <jfonseca at vmware.com>
---
src/mesa/state_tracker/st_cb_fbo.c | 8 +++++---
1 files changed, 5 insertions(+), 3 deletions(-)
diff --git a/src/mesa/state_tracker/st_cb_fbo.c b/src/mesa/state_tracker/st_cb_fbo.c
index 05a1dc6..04907c9 100644
--- a/src/mesa/state_tracker/st_cb_fbo.c
+++ b/src/mesa/state_tracker/st_cb_fbo.c
@@ -228,8 +228,10 @@ static void
st_renderbuffer_delete(struct gl_context *ctx, struct gl_renderbuffer *rb)
{
struct st_renderbuffer *strb = st_renderbuffer(rb);
- ASSERT(strb);
- pipe_surface_reference(&strb->surface, NULL);
+ struct st_context *st = st_context(ctx);
+ struct pipe_context *pipe = st->pipe;
+
+ pipe_surface_release(pipe, &strb->surface);
pipe_resource_reference(&strb->texture, NULL);
free(strb->data);
_mesa_delete_renderbuffer(ctx, rb);
@@ -434,7 +436,7 @@ st_render_texture(struct gl_context *ctx,
pipe_resource_reference( &strb->texture, pt );
- pipe_surface_reference(&strb->surface, NULL);
+ pipe_surface_release(pipe, &strb->surface);
assert(strb->rtt_level <= strb->texture->last_level);
More information about the mesa-commit
mailing list