From: Brian Paul <brianp@vmware.com>
Date: Thu, 15 May 2014 21:49:14 +0000 (-0600)
Subject: mesa: fix double-freeing of dispatch tables inside glBegin/End.
X-Git-Url: https://git.libre-soc.org/?a=commitdiff_plain;h=ef6b6658f91bd5871739bdb71a08042f26abe389;p=mesa.git

mesa: fix double-freeing of dispatch tables inside glBegin/End.

We allocate dispatch tables for BeginEnd and OutsideBeginEnd.  But
when we destroy the context we were freeing the BeginEnd and Exec
tables.  If Exec==BeginEnd we did a double-free.  This would happen
if the context was destroyed while inside a glBegin/End pair.  Now
free the BeginEnd and OutsideBeginEnd pointers.

Cc: "10.1", "10.2" <mesa-stable@lists.freedesktop.org>
Reviewed-by: Michel Dänzer <michel.daenzer@amd.com>
---

diff --git a/src/mesa/main/context.c b/src/mesa/main/context.c
index 860ae860531..8eb426d5904 100644
--- a/src/mesa/main/context.c
+++ b/src/mesa/main/context.c
@@ -1141,7 +1141,7 @@ _mesa_initialize_context(struct gl_context *ctx,
 fail:
    _mesa_reference_shared_state(ctx, &ctx->Shared, NULL);
    free(ctx->BeginEnd);
-   free(ctx->Exec);
+   free(ctx->OutsideBeginEnd);
    free(ctx->Save);
    return GL_FALSE;
 }
@@ -1242,7 +1242,7 @@ _mesa_free_context_data( struct gl_context *ctx )
 
    /* free dispatch tables */
    free(ctx->BeginEnd);
-   free(ctx->Exec);
+   free(ctx->OutsideBeginEnd);
    free(ctx->Save);
 
    /* Shared context state (display lists, textures, etc) */