diff options
| author | Ian Romanick <ian.d.romanick@intel.com> | 2014-01-21 16:52:42 -0800 |
|---|---|---|
| committer | Ian Romanick <ian.d.romanick@intel.com> | 2014-01-24 13:43:10 -0800 |
| commit | c11d76c51a29ed4fe02a8c46ba9fd64083f155ed (patch) | |
| tree | 5c3a48a7d782fdbc69e8f02800faf28f379d932a /src/mesa/main/dlist.c | |
| parent | a44554870ef4d5bc42c4b34aa1ce8d6979ddd92c (diff) | |
| download | external_mesa3d-c11d76c51a29ed4fe02a8c46ba9fd64083f155ed.zip external_mesa3d-c11d76c51a29ed4fe02a8c46ba9fd64083f155ed.tar.gz external_mesa3d-c11d76c51a29ed4fe02a8c46ba9fd64083f155ed.tar.bz2 | |
mesa: Increment the list pointer while freeing instruction data
Since the list pointer was never incremented when a OPCODE_PIXEL_MAP
opcode was encountered, the data for the instruction would get freed
over and over and over... resulting in a crash.
Fixes gl-1.0-beginend-coverage.
Signed-off-by: Ian Romanick <ian.d.romanick@intel.com>
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=72214
Reviewed-by: Brian Paul <brianp@vmware.com>
Cc: Lu Ha <huax.lu@intel.com>
Diffstat (limited to 'src/mesa/main/dlist.c')
| -rw-r--r-- | src/mesa/main/dlist.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/src/mesa/main/dlist.c b/src/mesa/main/dlist.c index cb40ff4..08943c9 100644 --- a/src/mesa/main/dlist.c +++ b/src/mesa/main/dlist.c @@ -767,6 +767,7 @@ _mesa_delete_list(struct gl_context *ctx, struct gl_display_list *dlist) break; case OPCODE_PIXEL_MAP: free(get_pointer(&n[3])); + n += InstSize[n[0].opcode]; break; case OPCODE_CONTINUE: |