From: Nicolai Hähnle Date: Fri, 27 Jan 2017 10:55:14 +0000 (+0100) Subject: dri/common: clear the loaderPrivate pointer in driDestroyDrawable X-Git-Url: https://git.libre-soc.org/?a=commitdiff_plain;h=7be0e602ed82d25b9f0db77748618c663d9cbfe7;p=mesa.git dri/common: clear the loaderPrivate pointer in driDestroyDrawable The GLX specification says about glXDestroyPixmap: "The storage for the GLX pixmap will be freed when it is not current to any client." We're not really following this language to the letter: some of the storage is freed immediately (in particular, the dri3_drawable, which contains both GLXDRIdrawable and loader_dri3_drawable). So we NULL out the pointers to that freed storage; the previous patches added the corresponding NULL-pointer checks. This fixes memory corruption in piglit ./bin/glx-visuals-depth/stencil -pixmap -auto Cc: 17.0 Reviewed-by: Marek Olšák Reviewed-by: Emil Velikov --- diff --git a/src/mesa/drivers/dri/common/dri_util.c b/src/mesa/drivers/dri/common/dri_util.c index f92eee9081d..d18c458d186 100644 --- a/src/mesa/drivers/dri/common/dri_util.c +++ b/src/mesa/drivers/dri/common/dri_util.c @@ -645,6 +645,8 @@ driCreateNewDrawable(__DRIscreen *screen, { __DRIdrawable *pdraw; + assert(data != NULL); + pdraw = malloc(sizeof *pdraw); if (!pdraw) return NULL; @@ -674,6 +676,16 @@ driCreateNewDrawable(__DRIscreen *screen, static void driDestroyDrawable(__DRIdrawable *pdp) { + /* + * The loader's data structures are going away, even if pdp itself stays + * around for the time being because it is currently bound. This happens + * when a currently bound GLX pixmap is destroyed. + * + * Clear out the pointer back into the loader's data structures to avoid + * accessing an outdated pointer. + */ + pdp->loaderPrivate = NULL; + dri_put_drawable(pdp); }