glx: Free DRI2 drawable reference to destroyed GLX drawable.
Otherwise the reference can lead to use after free in __glXDRIinvalidateBuffers(). Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=50019 Signed-off-by: Michel Dänzer <michel.daenzer@amd.com> Reviewed-by: Kristian Høgsberg <krh@bitplanet.net> Signed-off-by: Keith Packard <keithp@keithp.com>
This commit is contained in:
parent
8a87acc9e5
commit
a2d0829531
|
@ -106,6 +106,7 @@ struct __GLXDRIdrawable {
|
||||||
int height;
|
int height;
|
||||||
__DRIbuffer buffers[MAX_DRAWABLE_BUFFERS];
|
__DRIbuffer buffers[MAX_DRAWABLE_BUFFERS];
|
||||||
int count;
|
int count;
|
||||||
|
XID dri2_id;
|
||||||
};
|
};
|
||||||
|
|
||||||
static void
|
static void
|
||||||
|
@ -114,6 +115,8 @@ __glXDRIdrawableDestroy(__GLXdrawable * drawable)
|
||||||
__GLXDRIdrawable *private = (__GLXDRIdrawable *) drawable;
|
__GLXDRIdrawable *private = (__GLXDRIdrawable *) drawable;
|
||||||
const __DRIcoreExtension *core = private->screen->core;
|
const __DRIcoreExtension *core = private->screen->core;
|
||||||
|
|
||||||
|
FreeResource(private->dri2_id, FALSE);
|
||||||
|
|
||||||
(*core->destroyDrawable) (private->driDrawable);
|
(*core->destroyDrawable) (private->driDrawable);
|
||||||
|
|
||||||
__glXDrawableRelease(drawable);
|
__glXDrawableRelease(drawable);
|
||||||
|
@ -670,8 +673,9 @@ __glXDRIscreenCreateDrawable(ClientPtr client,
|
||||||
private->base.waitGL = __glXDRIdrawableWaitGL;
|
private->base.waitGL = __glXDRIdrawableWaitGL;
|
||||||
private->base.waitX = __glXDRIdrawableWaitX;
|
private->base.waitX = __glXDRIdrawableWaitX;
|
||||||
|
|
||||||
if (DRI2CreateDrawable(client, pDraw, drawId,
|
if (DRI2CreateDrawable2(client, pDraw, drawId,
|
||||||
__glXDRIinvalidateBuffers, private)) {
|
__glXDRIinvalidateBuffers, private,
|
||||||
|
&private->dri2_id)) {
|
||||||
free(private);
|
free(private);
|
||||||
return NULL;
|
return NULL;
|
||||||
}
|
}
|
||||||
|
|
Loading…
Reference in New Issue
Block a user