diff options
| author | Thomas Hindoe Paaboel Andersen <[email protected]> | 2016-03-05 13:07:07 +0100 |
|---|---|---|
| committer | Julien Isorce <[email protected]> | 2016-04-08 06:57:17 +0100 |
| commit | b9855dcdf7c94605305d6372d1f9883f76d10b6a (patch) | |
| tree | 0dd54e5f9feafcebfbca3ffcec0ec77648f61ac2 | |
| parent | 1cd19ebc4a892ada69f9085892441c00674b2764 (diff) | |
st/va: avoid dereference after free in vlVaDestroyImage
Cc: "11.1 11.2" <[email protected]>
Reviewed-by: Emil Velikov <[email protected]>
Tested-by: Julien Isorce <[email protected]>
| -rw-r--r-- | src/gallium/state_trackers/va/image.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/src/gallium/state_trackers/va/image.c b/src/gallium/state_trackers/va/image.c index 2c42a985823..92d014c3d44 100644 --- a/src/gallium/state_trackers/va/image.c +++ b/src/gallium/state_trackers/va/image.c @@ -280,6 +280,7 @@ vlVaDestroyImage(VADriverContextP ctx, VAImageID image) { vlVaDriver *drv; VAImage *vaimage; + VAStatus status; if (!ctx) return VA_STATUS_ERROR_INVALID_CONTEXT; @@ -294,8 +295,9 @@ vlVaDestroyImage(VADriverContextP ctx, VAImageID image) handle_table_remove(VL_VA_DRIVER(ctx)->htab, image); pipe_mutex_unlock(drv->mutex); + status = vlVaDestroyBuffer(ctx, vaimage->buf); FREE(vaimage); - return vlVaDestroyBuffer(ctx, vaimage->buf); + return status; } VAStatus |