From: Brian Paul <brianp@vmware.com>
Date: Mon, 24 May 2010 22:20:30 +0000 (-0600)
Subject: sw/xlib: NULL-out pointers after freeing image data
X-Git-Url: https://git.libre-soc.org/?a=commitdiff_plain;h=e5d0c730d124aa5ed380ed29162ea76329898844;p=mesa.git

sw/xlib: NULL-out pointers after freeing image data

This fixes a double-free() error when not using a shared memory XImage.
The XDestroyImage() function frees the ximage->data buffer if non-NULL.
If we free it ourselves, we also need to NULL-out the pointer.
---

diff --git a/src/gallium/winsys/sw/xlib/xlib_sw_winsys.c b/src/gallium/winsys/sw/xlib/xlib_sw_winsys.c
index 56d2df825df..3d702ae08dc 100644
--- a/src/gallium/winsys/sw/xlib/xlib_sw_winsys.c
+++ b/src/gallium/winsys/sw/xlib/xlib_sw_winsys.c
@@ -255,11 +255,17 @@ xm_displaytarget_destroy(struct sw_winsys *ws,
       }
       else {
          FREE(xm_dt->data);
+         if (xm_dt->tempImage->data == xm_dt->data) {
+            xm_dt->tempImage->data = NULL;
+         }
+         xm_dt->data = NULL;
       }
    }
 
-   if (xm_dt->tempImage)
+   if (xm_dt->tempImage) {
       XDestroyImage(xm_dt->tempImage);
+      xm_dt->tempImage = NULL;
+   }
 
    if (xm_dt->gc)
       XFreeGC(xm_dt->display, xm_dt->gc);