[Mesa-dev] [PATCH] st/mesa: Fix NULL pointer dereference for incomplete framebuffers

[Brian Paul]

On 04/24/2014 08:45 PM, Michel Dänzer wrote:
> From: Michel Dänzer <michel.daenzer at amd.com>
>
> This can happen with glamor, which uses EGL_KHR_surfaceless_context and
> only explicitly binds GL_READ_FRAMEBUFFER for glReadPixels.
>
> Cc: mesa-stable at lists.freedesktop.org
> Signed-off-by: Michel Dänzer <michel.daenzer at amd.com>
> ---
>   src/mesa/state_tracker/st_manager.c | 7 ++++++-
>   1 file changed, 6 insertions(+), 1 deletion(-)
>
> diff --git a/src/mesa/state_tracker/st_manager.c b/src/mesa/state_tracker/st_manager.c
> index 314d342..91fee69 100644
> --- a/src/mesa/state_tracker/st_manager.c
> +++ b/src/mesa/state_tracker/st_manager.c
> @@ -183,8 +183,13 @@ st_framebuffer_validate(struct st_framebuffer *stfb,
>      uint width, height;
>      unsigned i;
>      boolean changed = FALSE;
> -   int32_t new_stamp = p_atomic_read(&stfb->iface->stamp);
> +   int32_t new_stamp;
>
> +   /* Check for incomplete framebuffers (e.g. EGL_KHR_surfaceless_context) */
> +   if (!stfb->iface)
> +      return;
> +
> +   new_stamp = p_atomic_read(&stfb->iface->stamp);
>      if (stfb->iface_stamp == new_stamp)
>         return;
>
>

Reviewed-by: Brian Paul <brianp at vmware.com>