From 63da1aa5be4aa3e14a0456daf863c1bf10de619f Mon Sep 17 00:00:00 2001 From: =?utf8?q?Jos=C3=A9=20Fonseca?= Date: Wed, 25 Apr 2012 11:41:13 +0100 Subject: [PATCH] mesa/st: Fix derreference after free. --- src/mesa/state_tracker/st_context.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/src/mesa/state_tracker/st_context.c b/src/mesa/state_tracker/st_context.c index 84aae814416..19d9da131f3 100644 --- a/src/mesa/state_tracker/st_context.c +++ b/src/mesa/state_tracker/st_context.c @@ -270,6 +270,7 @@ static void st_destroy_context_priv( struct st_context *st ) void st_destroy_context( struct st_context *st ) { struct pipe_context *pipe = st->pipe; + struct u_vbuf *vbuf = st->vbuf; struct cso_context *cso = st->cso_context; struct gl_context *ctx = st->ctx; GLuint i; @@ -300,10 +301,13 @@ void st_destroy_context( struct st_context *st ) _mesa_free_context_data(ctx); + /* This will free the st_context too, so 'st' must not be accessed + * afterwards. */ st_destroy_context_priv(st); + st = NULL; - if (st->vbuf) - u_vbuf_destroy(st->vbuf); + if (vbuf) + u_vbuf_destroy(vbuf); cso_destroy_context(cso); -- 2.30.2