diff options
| author | Michel Dänzer <daenzer@vmware.com> | 2009-04-30 13:21:08 +0200 |
|---|---|---|
| committer | Michel Dänzer <daenzer@vmware.com> | 2009-04-30 13:21:08 +0200 |
| commit | c28707b50701b1cf8727be29d61e2d939c6ee58f (patch) | |
| tree | 97266614c6e162f4730427c2e4e33f547fcd9def /src/mesa/drivers/dri/r300/r300_texmem.c | |
| parent | ba27fe3710af4933a16278a3e97162bef1737b56 (diff) | |
| download | external_mesa3d-c28707b50701b1cf8727be29d61e2d939c6ee58f.zip external_mesa3d-c28707b50701b1cf8727be29d61e2d939c6ee58f.tar.gz external_mesa3d-c28707b50701b1cf8727be29d61e2d939c6ee58f.tar.bz2 | |
r300: Increase reference count of texture objects referenced by current state.
Fixes a use-after-free reported in
http://bugs.freedesktop.org/show_bug.cgi?id=20539, so this possibly fixes that
bug. It has been confirmed to fix
http://bugs.freedesktop.org/show_bug.cgi?id=17895 .
Diffstat (limited to 'src/mesa/drivers/dri/r300/r300_texmem.c')
| -rw-r--r-- | src/mesa/drivers/dri/r300/r300_texmem.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/src/mesa/drivers/dri/r300/r300_texmem.c b/src/mesa/drivers/dri/r300/r300_texmem.c index 0fe51b0..a89ab83 100644 --- a/src/mesa/drivers/dri/r300/r300_texmem.c +++ b/src/mesa/drivers/dri/r300/r300_texmem.c @@ -44,6 +44,7 @@ SOFTWARE. #include "main/colormac.h" #include "main/macros.h" #include "main/simple_list.h" +#include "main/texobj.h" #include "radeon_reg.h" /* gets definition for usleep */ #include "r300_context.h" #include "r300_state.h" @@ -71,8 +72,8 @@ void r300DestroyTexObj(r300ContextPtr rmesa, r300TexObjPtr t) } for (i = 0; i < rmesa->radeon.glCtx->Const.MaxTextureUnits; i++) { - if (rmesa->state.texture.unit[i].texobj == t) { - rmesa->state.texture.unit[i].texobj = NULL; + if (rmesa->state.texture.unit[i].texobj == t->base.tObj) { + _mesa_reference_texobj(&rmesa->state.texture.unit[i].texobj, NULL); } } } |