glx: Fix use after free in MakeCurrent
The fix from commitc468d34c7
- "glx: Set ContextTag for all contexts" is actually incomplete, it correctly sets the context tag for direct contexts as well, but would fail to mark the context's currentClient. As a result, when the context is destroyed, it would be freed immediately rather than being just scheduled for deletion, even though it is still current for some client. leading to a use-after-free. Make sure to also set the context's currentClient for direct contexts as well, not just indirect ones. Signed-off-by: Olivier Fourdan <ofourdan@redhat.com> Fixes:c468d34c7
- "glx: Set ContextTag for all contexts" Closes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1186 Reviewed-by: Adam Jackson <ajax@redhat.com>
This commit is contained in:
parent
021b3c2f77
commit
aad61e8e03
|
@ -662,11 +662,11 @@ xorgGlxMakeCurrent(ClientPtr client, GLXContextTag tag, XID drawId, XID readId,
|
|||
glxc->readPriv = NULL;
|
||||
return __glXError(GLXBadContext);
|
||||
}
|
||||
|
||||
glxc->currentClient = client;
|
||||
}
|
||||
|
||||
glxServer.setContextTagPrivate(client, newContextTag, glxc);
|
||||
if (glxc)
|
||||
glxc->currentClient = client;
|
||||
|
||||
if (prevglxc) {
|
||||
prevglxc->currentClient = NULL;
|
||||
|
|
Loading…
Reference in New Issue