From 8dc2085baf954e7d52159797fe3051a554df3f6d Mon Sep 17 00:00:00 2001
From: =?utf8?q?Hanno=20B=C3=B6ck?= <hanno@hboeck.de>
Date: Wed, 7 Nov 2018 09:01:42 +0100
Subject: [PATCH] glsl/test: Fix use after free in test_optpass.
MIME-Version: 1.0
Content-Type: text/plain; charset=utf8
Content-Transfer-Encoding: 8bit

The variable state is free'd and afterwards state->error is used
as the return value, resulting in a use after free bug detected
by memory safety tools like address sanitizer.

Signed-off-by: Hanno Böck <hanno@hboeck.de>
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=108636
Reviewed-by: Eric Engestrom <eric.engestrom@intel.com>
Reviewed-by: Tapani Pälli <tapani.palli@intel.com>
---
 src/compiler/glsl/test_optpass.cpp | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/compiler/glsl/test_optpass.cpp b/src/compiler/glsl/test_optpass.cpp
index 735129d91e9..638ffeb2fe4 100644
--- a/src/compiler/glsl/test_optpass.cpp
+++ b/src/compiler/glsl/test_optpass.cpp
@@ -166,6 +166,7 @@ int test_optpass(int argc, char **argv)
    int loop = 0;
    int shader_type = GL_VERTEX_SHADER;
    int quiet = 0;
+   int error;
 
    const struct option optpass_opts[] = {
       { "input-ir", no_argument, &input_format_ir, 1 },
@@ -264,9 +265,11 @@ int test_optpass(int argc, char **argv)
       printf("--\n");
    }
 
+   error = state->error;
+
    ralloc_free(state);
    ralloc_free(shader);
 
-   return state->error;
+   return error;
 }
 
-- 
2.30.2