intel: Deassociated drawables from private context struct in intelUnbindContext

The generic DRI infrastructure makes sure that __DRIcontextRec::driDrawablePriv
and __DRIcontextRec::driReadablePriv are set to NULL after unbinding a
context.  However, the intel_context structure keeps cached copies of
these pointers.  If these cached pointers are not NULLed and the
drawable is actually destroyed after unbinding the context (typically
by way of glXDestroyWindow), freed memory will be dereferenced in
intelDestroyContext.

This should fix bug #23418.

diff --git a/src/mesa/drivers/dri/intel/intel_context.c b/src/mesa/drivers/dri/intel/intel_context.c
index aecb317eb83c87e524073e1db05a6c58f3f0fd7f..7fa70e428d06a1dfc7256531f488bce572465e67 100644 (file)
--- a/src/mesa/drivers/dri/intel/intel_context.c
+++ b/src/mesa/drivers/dri/intel/intel_context.c
@@ -840,6 +840,14 @@ intelDestroyContext(__DRIcontextPrivate * driContextPriv)
 GLboolean
 intelUnbindContext(__DRIcontextPrivate * driContextPriv)
 {
+   struct intel_context *intel =
+      (struct intel_context *) driContextPriv->driverPrivate;
+
+   /* Deassociate the context with the drawables.
+    */
+   intel->driDrawable = NULL;
+   intel->driReadDrawable = NULL;
+
    return GL_TRUE;
 }