[Mesa-dev] [PATCH] st/va: avoid dereference after free

[Julien Isorce]

Hi Thomas and Emil, I tested it and pushed. Thx a lot.

On 6 April 2016 at 21:34, Thomas H.P. Andersen <phomes at gmail.com> wrote:

>
>
> On Sun, Mar 6, 2016 at 10:08 AM, Thomas H.P. Andersen <phomes at gmail.com>
> wrote:
>
>>
>>
>> On Sat, Mar 5, 2016 at 1:30 PM, Emil Velikov <emil.l.velikov at gmail.com>
>> wrote:
>>
>>> Hi Thomas,
>>>
>>> On 5 March 2016 at 12:07, Thomas Hindoe Paaboel Andersen
>>> <phomes at gmail.com> wrote:
>>> > ---
>>> >  src/gallium/state_trackers/va/image.c | 4 +++-
>>> >  1 file changed, 3 insertions(+), 1 deletion(-)
>>> >
>>> > diff --git a/src/gallium/state_trackers/va/image.c
>>> b/src/gallium/state_trackers/va/image.c
>>> > index 2c42a98..92d014c 100644
>>> > --- a/src/gallium/state_trackers/va/image.c
>>> > +++ b/src/gallium/state_trackers/va/image.c
>>> > @@ -280,6 +280,7 @@ vlVaDestroyImage(VADriverContextP ctx, VAImageID
>>> image)
>>> >  {
>>> >     vlVaDriver *drv;
>>> >     VAImage  *vaimage;
>>> > +   VAStatus status;
>>> >
>>> >     if (!ctx)
>>> >        return VA_STATUS_ERROR_INVALID_CONTEXT;
>>> > @@ -294,8 +295,9 @@ vlVaDestroyImage(VADriverContextP ctx, VAImageID
>>> image)
>>> >
>>> >     handle_table_remove(VL_VA_DRIVER(ctx)->htab, image);
>>> >     pipe_mutex_unlock(drv->mutex);
>>> > +   status = vlVaDestroyBuffer(ctx, vaimage->buf);
>>> >     FREE(vaimage);
>>> > -   return vlVaDestroyBuffer(ctx, vaimage->buf);
>>> > +   return status;
>>>
>>> Nicely spotted !
>>> Out of curiosity: did you notice this during code inspection or did it
>>> pop up during testing ?
>>>
>>
>> Thanks for the review! I only saw it by inspection. I am just poking
>> around a bit to get to know the code.
>>
>>
>>>
>>> For the patch
>>>
>>> Cc: "11.1 11.2" <mesa-stable at lists.freedesktop.org>
>>> Reviewed-by: Emil Velikov <emil.l.velikov at gmail.com>
>>>
>>> I'll push this in a couple of days unless someone beats me to it.
>>>
>>
> Hi Emil,
>
> Friendly ping :)
>
> _______________________________________________
> mesa-dev mailing list
> mesa-dev at lists.freedesktop.org
> https://lists.freedesktop.org/mailman/listinfo/mesa-dev
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.freedesktop.org/archives/mesa-dev/attachments/20160408/9563d946/attachment.html>