mesa/swrast: Move free calls outside the attachment loop

This was originally discovered by Klocwork analysis:

    Possible memory leak. Dynamic memory stored in 'srcBuffer0'
    allocated through function 'malloc' at line 566 can be lost at line
    746

However, I think the problem is actually much worse.  Since the memory
is freed after the first pass through the loop, the released buffer may
be used on the next iteration!

NOTE: This is a candidate for stable release branches.

Signed-off-by: Ian Romanick <ian.d.romanick@intel.com>
Reviewed-by: Brian Paul <brianp@vmware.com>
Reviewed-by: Kenneth Graunke <kenneth@whitecape.org>

diff --git a/src/mesa/swrast/s_blit.c b/src/mesa/swrast/s_blit.c
index f77981f3c49d4f9c95184f66e966abbe3fd0dcf4..ecec734c233debec6a2dc2ff528c0b96165e7bfb 100644 (file)
--- a/src/mesa/swrast/s_blit.c
+++ b/src/mesa/swrast/s_blit.c
@@ -710,16 +710,17 @@ blit_linear(struct gl_context *ctx,
          }
       }
 
-      free(srcBuffer0);
-      free(srcBuffer1);
-      free(dstBuffer);
-
       ctx->Driver.UnmapRenderbuffer(ctx, readRb);
       if (drawRb != readRb) {
          ctx->Driver.UnmapRenderbuffer(ctx, drawRb);
       }
    }
 
+   free(srcBuffer0);
+   free(srcBuffer1);
+   free(dstBuffer);
+   return;
+
 fail_no_memory:
    free(srcBuffer0);
    free(srcBuffer1);