Mesa (master): mapi: Make private copies of name strings provided by client.

[Emil Velikov]

Module: Mesa
Branch: master
Commit: 1110113a7f0b6f9b21dd26dee8e95a021041c71c
URL:    http://cgit.freedesktop.org/mesa/mesa/commit/?id=1110113a7f0b6f9b21dd26dee8e95a021041c71c

Author: Mario Kleiner <mario.kleiner.de at gmail.com>
Date:   Thu Mar 12 23:34:12 2015 +0100

mapi: Make private copies of name strings provided by client.

glXGetProcAddress("glFoo") ends up in stub_add_dynamic() to
create dynamic stubs for dynamic functions. stub_add_dynamic()
doesn't store the caller provided name string "Foo" in a mesa
private copy, but just stores a pointer to the "glFoo" string
passed to glXGetProcAddress - a pointer into arbitrary memory
outside mesa's control.

If the caller passes some dynamically allocated/changing
memory buffer to glXGetProcAddress(), or the caller gets unmapped
from memory, e.g., some dynamically loaded application
plugin which uses OpenGL, this ends badly - with a dangling
pointer.

strdup() the name string provided by the client to avoid
this problem.

Cc: "10.3 10.4 10.5" <mesa-stable at lists.freedesktop.org>
Signed-off-by: Mario Kleiner <mario.kleiner.de at gmail.com>
Reviewed-by: Brian Paul <brianp at vmware.com>

---

 src/mapi/stub.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/mapi/stub.c b/src/mapi/stub.c
index 05436ba..45e4f7d 100644
--- a/src/mapi/stub.c
+++ b/src/mapi/stub.c
@@ -102,7 +102,7 @@ stub_add_dynamic(const char *name)
    if (!stub->addr)
       return NULL;
 
-   stub->name = (const void *) name;
+   stub->name = (const void *) strdup(name);
    /* to be fixed later */
    stub->slot = -1;