diff options
| author | Mario Kleiner <mario.kleiner.de@gmail.com> | 2015-03-12 23:34:12 +0100 |
|---|---|---|
| committer | Emil Velikov <emil.l.velikov@gmail.com> | 2015-03-23 22:17:03 +0000 |
| commit | 1110113a7f0b6f9b21dd26dee8e95a021041c71c (patch) | |
| tree | 30bbcd5c283c77d06efd06139a5af1beeacb3b47 /src/mapi/stub.c | |
| parent | dfb1ae9d914b7723ef50fdd2efe811feebc045ad (diff) | |
| download | external_mesa3d-1110113a7f0b6f9b21dd26dee8e95a021041c71c.zip external_mesa3d-1110113a7f0b6f9b21dd26dee8e95a021041c71c.tar.gz external_mesa3d-1110113a7f0b6f9b21dd26dee8e95a021041c71c.tar.bz2 | |
mapi: Make private copies of name strings provided by client.
glXGetProcAddress("glFoo") ends up in stub_add_dynamic() to
create dynamic stubs for dynamic functions. stub_add_dynamic()
doesn't store the caller provided name string "Foo" in a mesa
private copy, but just stores a pointer to the "glFoo" string
passed to glXGetProcAddress - a pointer into arbitrary memory
outside mesa's control.
If the caller passes some dynamically allocated/changing
memory buffer to glXGetProcAddress(), or the caller gets unmapped
from memory, e.g., some dynamically loaded application
plugin which uses OpenGL, this ends badly - with a dangling
pointer.
strdup() the name string provided by the client to avoid
this problem.
Cc: "10.3 10.4 10.5" <mesa-stable@lists.freedesktop.org>
Signed-off-by: Mario Kleiner <mario.kleiner.de@gmail.com>
Reviewed-by: Brian Paul <brianp@vmware.com>
Diffstat (limited to 'src/mapi/stub.c')
| -rw-r--r-- | src/mapi/stub.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/mapi/stub.c b/src/mapi/stub.c index 05436ba..45e4f7d 100644 --- a/src/mapi/stub.c +++ b/src/mapi/stub.c @@ -102,7 +102,7 @@ stub_add_dynamic(const char *name) if (!stub->addr) return NULL; - stub->name = (const void *) name; + stub->name = (const void *) strdup(name); /* to be fixed later */ stub->slot = -1; |