projects / mesa.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 2828680) | patch
mesa: fix _mesa_free_pipeline_data() use-after-free bug
authorBrian Paul <brianp@vmware.com>
Fri, 12 Sep 2014 12:29:04 +0000 (06:29 -0600)
committerBrian Paul <brianp@vmware.com>
Fri, 12 Sep 2014 15:17:31 +0000 (09:17 -0600)
commit0d73ac6b02cac46d4a8f3cd1ffa591e071577fa7
tree905dd8479127949f9d4d15d9e6753c37219ef842tree
parent2828680e39e843514a38781878e2a3534f876233commit | diff
mesa: fix _mesa_free_pipeline_data() use-after-free bug

Unreference the ctx->_Shader object before we delete all the pipeline
objects in the hash table.  Before, ctx->_Shader could point to freed
memory when _mesa_reference_pipeline_object(ctx, &ctx->_Shader, NULL)
was called.

Fixes crash when exiting the piglit rendezvous_by_location test on
Windows.

Cc: mesa-stable@lists.freedesktop.org
Reviewed-by: Ian Romanick <ian.d.romanick@intel.com>
src/mesa/main/pipelineobj.c diff | blob | history