diff options
| author | Brian Paul <brianp@vmware.com> | 2014-09-12 06:29:04 -0600 |
|---|---|---|
| committer | Brian Paul <brianp@vmware.com> | 2014-09-12 09:17:31 -0600 |
| commit | 0d73ac6b02cac46d4a8f3cd1ffa591e071577fa7 (patch) | |
| tree | 905dd8479127949f9d4d15d9e6753c37219ef842 /src/mesa/main/pipelineobj.c | |
| parent | 2828680e39e843514a38781878e2a3534f876233 (diff) | |
| download | external_mesa3d-0d73ac6b02cac46d4a8f3cd1ffa591e071577fa7.zip external_mesa3d-0d73ac6b02cac46d4a8f3cd1ffa591e071577fa7.tar.gz external_mesa3d-0d73ac6b02cac46d4a8f3cd1ffa591e071577fa7.tar.bz2 | |
mesa: fix _mesa_free_pipeline_data() use-after-free bug
Unreference the ctx->_Shader object before we delete all the pipeline
objects in the hash table. Before, ctx->_Shader could point to freed
memory when _mesa_reference_pipeline_object(ctx, &ctx->_Shader, NULL)
was called.
Fixes crash when exiting the piglit rendezvous_by_location test on
Windows.
Cc: mesa-stable@lists.freedesktop.org
Reviewed-by: Ian Romanick <ian.d.romanick@intel.com>
Diffstat (limited to 'src/mesa/main/pipelineobj.c')
| -rw-r--r-- | src/mesa/main/pipelineobj.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/src/mesa/main/pipelineobj.c b/src/mesa/main/pipelineobj.c index 017d425..b713d95 100644 --- a/src/mesa/main/pipelineobj.c +++ b/src/mesa/main/pipelineobj.c @@ -120,12 +120,12 @@ delete_pipelineobj_cb(GLuint id, void *data, void *userData) void _mesa_free_pipeline_data(struct gl_context *ctx) { + _mesa_reference_pipeline_object(ctx, &ctx->_Shader, NULL); + _mesa_HashDeleteAll(ctx->Pipeline.Objects, delete_pipelineobj_cb, ctx); _mesa_DeleteHashTable(ctx->Pipeline.Objects); - _mesa_reference_pipeline_object(ctx, &ctx->_Shader, NULL); _mesa_delete_pipeline_object(ctx, ctx->Pipeline.Default); - } /** |