From: Brian Paul <brianp@vmware.com>
Date: Fri, 18 Apr 2014 18:20:28 +0000 (-0600)
Subject: st/mesa: fix invalid pointer use in st_texture_get_sampler_view()
X-Git-Url: https://git.libre-soc.org/?a=commitdiff_plain;h=27496af67f1a15a3a9aa5d5e09d43d9365101f71;p=mesa.git

st/mesa: fix invalid pointer use in st_texture_get_sampler_view()

The '**used' pointer was pointing into the stObj->sampler_views array.
If 'free' was null, we'd realloc that array, thus making the 'used'
pointer invalid.  This soon led to memory errors.

Just change the pointer to be '*used' so it points directly at the
pipe_sampler_view.

Reviewed-by: Michel Dänzer <michel.daenzer@amd.com>
---

diff --git a/src/mesa/state_tracker/st_texture.c b/src/mesa/state_tracker/st_texture.c
index f664ef5f140..92035e8016e 100644
--- a/src/mesa/state_tracker/st_texture.c
+++ b/src/mesa/state_tracker/st_texture.c
@@ -443,7 +443,7 @@ struct pipe_sampler_view **
 st_texture_get_sampler_view(struct st_context *st,
                             struct st_texture_object *stObj)
 {
-   struct pipe_sampler_view **used = NULL, **free = NULL;
+   struct pipe_sampler_view *used = NULL, **free = NULL;
    GLuint i;
 
    for (i = 0; i < stObj->num_sampler_views; ++i) {
@@ -455,7 +455,7 @@ st_texture_get_sampler_view(struct st_context *st,
             return sv;
 
          /* Wasn't the right one, but remember it as template */
-         used = sv;
+         used = *sv;
       } else {
          /* Found a free slot, remember that */
          free = sv;
@@ -475,7 +475,7 @@ st_texture_get_sampler_view(struct st_context *st,
 
    /* Add just any sampler view to be used as a template */
    if (used)
-      pipe_sampler_view_reference(free, *used);
+      pipe_sampler_view_reference(free, used);
 
    return free;
 }