[Mesa-dev] [PATCH] glsl/test: Fix use after free in test_optpass.
Tapani Pälli
tapani.palli at intel.com
Thu Nov 8 06:52:09 UTC 2018
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=108636
Reviewed-by: Tapani Pälli <tapani.palli at intel.com>
On 11/7/18 10:01 AM, Hanno Böck wrote:
> The variable state is free'd and afterwards state->error is used
> as the return value, resulting in a use after free bug detected
> by memory safety tools like address sanitizer.
>
> Signed-off-by: Hanno Böck <hanno at hboeck.de>
> ---
> src/compiler/glsl/test_optpass.cpp | 5 ++++-
> 1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/src/compiler/glsl/test_optpass.cpp b/src/compiler/glsl/test_optpass.cpp
> index 735129d..638ffeb 100644
> --- a/src/compiler/glsl/test_optpass.cpp
> +++ b/src/compiler/glsl/test_optpass.cpp
> @@ -166,6 +166,7 @@ int test_optpass(int argc, char **argv)
> int loop = 0;
> int shader_type = GL_VERTEX_SHADER;
> int quiet = 0;
> + int error;
>
> const struct option optpass_opts[] = {
> { "input-ir", no_argument, &input_format_ir, 1 },
> @@ -264,9 +265,11 @@ int test_optpass(int argc, char **argv)
> printf("--\n");
> }
>
> + error = state->error;
> +
> ralloc_free(state);
> ralloc_free(shader);
>
> - return state->error;
> + return error;
> }
>
>
More information about the mesa-dev
mailing list