sw/xlib: NULL-out pointers after freeing image data

This fixes a double-free() error when not using a shared memory XImage.
The XDestroyImage() function frees the ximage->data buffer if non-NULL.
If we free it ourselves, we also need to NULL-out the pointer.

1 files changed, 7 insertions, 1 deletions

diff --git a/src/gallium/winsys/sw/xlib/xlib_sw_winsys.c b/src/gallium/winsys/sw/xlib/xlib_sw_winsys.c
index 56d2df825df..3d702ae08dc 100644
--- a/src/gallium/winsys/sw/xlib/xlib_sw_winsys.c
+++ b/src/gallium/winsys/sw/xlib/xlib_sw_winsys.c
@@ -255,11 +255,17 @@ xm_displaytarget_destroy(struct sw_winsys *ws,
       }
       else {
          FREE(xm_dt->data);
+         if (xm_dt->tempImage->data == xm_dt->data) {
+            xm_dt->tempImage->data = NULL;
+         }
+         xm_dt->data = NULL;
       }
    }
 
-   if (xm_dt->tempImage)
+   if (xm_dt->tempImage) {
       XDestroyImage(xm_dt->tempImage);
+      xm_dt->tempImage = NULL;
+   }
 
    if (xm_dt->gc)
       XFreeGC(xm_dt->display, xm_dt->gc);