Mesa (11.2): st/va: avoid dereference after free in vlVaDestroyImage
Emil Velikov
evelikov at kemper.freedesktop.org
Thu Apr 14 19:39:07 UTC 2016
Module: Mesa
Branch: 11.2
Commit: a2898b6bbc3804a5eaef37727e7e7049a93c9fc3
URL: http://cgit.freedesktop.org/mesa/mesa/commit/?id=a2898b6bbc3804a5eaef37727e7e7049a93c9fc3
Author: Thomas Hindoe Paaboel Andersen <phomes at gmail.com>
Date: Sat Mar 5 13:07:07 2016 +0100
st/va: avoid dereference after free in vlVaDestroyImage
Cc: "11.1 11.2" <mesa-stable at lists.freedesktop.org>
Reviewed-by: Emil Velikov <emil.l.velikov at gmail.com>
Tested-by: Julien Isorce <j.isorce at samsung.com>
(cherry picked from commit b9855dcdf7c94605305d6372d1f9883f76d10b6a)
---
src/gallium/state_trackers/va/image.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/src/gallium/state_trackers/va/image.c b/src/gallium/state_trackers/va/image.c
index 2c42a98..92d014c 100644
--- a/src/gallium/state_trackers/va/image.c
+++ b/src/gallium/state_trackers/va/image.c
@@ -280,6 +280,7 @@ vlVaDestroyImage(VADriverContextP ctx, VAImageID image)
{
vlVaDriver *drv;
VAImage *vaimage;
+ VAStatus status;
if (!ctx)
return VA_STATUS_ERROR_INVALID_CONTEXT;
@@ -294,8 +295,9 @@ vlVaDestroyImage(VADriverContextP ctx, VAImageID image)
handle_table_remove(VL_VA_DRIVER(ctx)->htab, image);
pipe_mutex_unlock(drv->mutex);
+ status = vlVaDestroyBuffer(ctx, vaimage->buf);
FREE(vaimage);
- return vlVaDestroyBuffer(ctx, vaimage->buf);
+ return status;
}
VAStatus
More information about the mesa-commit
mailing list