Mesa (master): st/mesa: fix invalid pointer use in st_texture_get_sampler_view()

[Brian Paul]

Module: Mesa
Branch: master
Commit: 27496af67f1a15a3a9aa5d5e09d43d9365101f71
URL:    http://cgit.freedesktop.org/mesa/mesa/commit/?id=27496af67f1a15a3a9aa5d5e09d43d9365101f71

Author: Brian Paul <brianp at vmware.com>
Date:   Fri Apr 18 12:20:28 2014 -0600

st/mesa: fix invalid pointer use in st_texture_get_sampler_view()

The '**used' pointer was pointing into the stObj->sampler_views array.
If 'free' was null, we'd realloc that array, thus making the 'used'
pointer invalid.  This soon led to memory errors.

Just change the pointer to be '*used' so it points directly at the
pipe_sampler_view.

Reviewed-by: Michel Dänzer <michel.daenzer at amd.com>

---

 src/mesa/state_tracker/st_texture.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/mesa/state_tracker/st_texture.c b/src/mesa/state_tracker/st_texture.c
index f664ef5..92035e8 100644
--- a/src/mesa/state_tracker/st_texture.c
+++ b/src/mesa/state_tracker/st_texture.c
@@ -443,7 +443,7 @@ struct pipe_sampler_view **
 st_texture_get_sampler_view(struct st_context *st,
                             struct st_texture_object *stObj)
 {
-   struct pipe_sampler_view **used = NULL, **free = NULL;
+   struct pipe_sampler_view *used = NULL, **free = NULL;
    GLuint i;
 
    for (i = 0; i < stObj->num_sampler_views; ++i) {
@@ -455,7 +455,7 @@ st_texture_get_sampler_view(struct st_context *st,
             return sv;
 
          /* Wasn't the right one, but remember it as template */
-         used = sv;
+         used = *sv;
       } else {
          /* Found a free slot, remember that */
          free = sv;
@@ -475,7 +475,7 @@ st_texture_get_sampler_view(struct st_context *st,
 
    /* Add just any sampler view to be used as a template */
    if (used)
-      pipe_sampler_view_reference(free, *used);
+      pipe_sampler_view_reference(free, used);
 
    return free;
 }