st/va: avoid dereference after free in vlVaDestroyImage

Cc: "11.1 11.2" <mesa-stable@lists.freedesktop.org>
Reviewed-by: Emil Velikov <emil.l.velikov@gmail.com>
Tested-by: Julien Isorce <j.isorce@samsung.com>

diff --git a/src/gallium/state_trackers/va/image.c b/src/gallium/state_trackers/va/image.c
index 2c42a985823c2ee8c9e451fd61475d778b4f8cf5..92d014c3d44ffce219539043cf8a4078279b687a 100644 (file)
--- a/src/gallium/state_trackers/va/image.c
+++ b/src/gallium/state_trackers/va/image.c
@@ -280,6 +280,7 @@ vlVaDestroyImage(VADriverContextP ctx, VAImageID image)
 {
    vlVaDriver *drv;
    VAImage  *vaimage;
+   VAStatus status;
 
    if (!ctx)
       return VA_STATUS_ERROR_INVALID_CONTEXT;
@@ -294,8 +295,9 @@ vlVaDestroyImage(VADriverContextP ctx, VAImageID image)
 
    handle_table_remove(VL_VA_DRIVER(ctx)->htab, image);
    pipe_mutex_unlock(drv->mutex);
+   status = vlVaDestroyBuffer(ctx, vaimage->buf);
    FREE(vaimage);
-   return vlVaDestroyBuffer(ctx, vaimage->buf);
+   return status;
 }
 
 VAStatus