mesa/swrast: Move free calls outside the attachment loop

This was originally discovered by Klocwork analysis:

    Possible memory leak. Dynamic memory stored in 'srcBuffer0'
    allocated through function 'malloc' at line 566 can be lost at line
    746

However, I think the problem is actually much worse.  Since the memory
is freed after the first pass through the loop, the released buffer may
be used on the next iteration!

NOTE: This is a candidate for stable release branches.

Signed-off-by: Ian Romanick <[email protected]>
Reviewed-by: Brian Paul <[email protected]>
Reviewed-by: Kenneth Graunke <[email protected]>

1 files changed, 5 insertions, 4 deletions

diff --git a/src/mesa/swrast/s_blit.c b/src/mesa/swrast/s_blit.c
index f77981f3c49..ecec734c233 100644
--- a/src/mesa/swrast/s_blit.c
+++ b/src/mesa/swrast/s_blit.c
@@ -710,16 +710,17 @@ blit_linear(struct gl_context *ctx,
          }
       }
 
-      free(srcBuffer0);
-      free(srcBuffer1);
-      free(dstBuffer);
-
       ctx->Driver.UnmapRenderbuffer(ctx, readRb);
       if (drawRb != readRb) {
          ctx->Driver.UnmapRenderbuffer(ctx, drawRb);
       }
    }
 
+   free(srcBuffer0);
+   free(srcBuffer1);
+   free(dstBuffer);
+   return;
+
 fail_no_memory:
    free(srcBuffer0);
    free(srcBuffer1);