diff options
| author | Jonas Maebe <jonas.maebe@elis.ugent.be> | 2012-04-23 16:02:16 -0700 |
|---|---|---|
| committer | Jeremy Huddleston <jeremyhu@apple.com> | 2012-04-23 16:17:39 -0700 |
| commit | c60ffd2840036af1ea6f2b6c6e1e9014bb8e2c34 (patch) | |
| tree | ba7e9fbd2433febc7827713f80cd8e2e80fdde76 | |
| parent | 802ca81e260f6ccfe2cf492e96b2887131bed09c (diff) | |
| download | external_mesa3d-c60ffd2840036af1ea6f2b6c6e1e9014bb8e2c34.zip external_mesa3d-c60ffd2840036af1ea6f2b6c6e1e9014bb8e2c34.tar.gz external_mesa3d-c60ffd2840036af1ea6f2b6c6e1e9014bb8e2c34.tar.bz2 | |
apple: Fix a use after free
Reviewed-by: Jeremy Huddleston <jeremyhu@apple.com>
| -rw-r--r-- | src/glx/apple/apple_glx_surface.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/src/glx/apple/apple_glx_surface.c b/src/glx/apple/apple_glx_surface.c index 39f5130..d42fa3b 100644 --- a/src/glx/apple/apple_glx_surface.c +++ b/src/glx/apple/apple_glx_surface.c @@ -206,6 +206,10 @@ apple_glx_surface_destroy(unsigned int uid) if (d) { d->types.surface.pending_destroy = true; d->release(d); + + /* apple_glx_drawable_find_by_uid returns a locked drawable */ + d->unlock(d); + /* * We release 2 references to the surface. One was acquired by * the find, and the other was leftover from a context, or @@ -217,7 +221,5 @@ apple_glx_surface_destroy(unsigned int uid) * by a glViewport callback (see apple_glx_context_update()). */ d->destroy(d); - - d->unlock(d); } } |