diff options
| author | Jonas Ådahl <[email protected]> | 2012-10-28 00:50:12 +0200 |
|---|---|---|
| committer | Kristian Høgsberg <[email protected]> | 2012-11-07 16:13:03 -0500 |
| commit | a3b6b2d3055070da9bf7054fecfd0b171c398eb7 (patch) | |
| tree | 4064e9278000438ef021e22183bd121452ca050a /src/gallium | |
| parent | 0b61f0b14894792baa48d59ff3df167334c7d83e (diff) | |
wayland: Destroy frame callback when destroying surface
If a frame callback is not destroyed when destroying a surface, its
handler function will be invoked if the surface was destroyed after the
callback was requested but before it was invoked, causing a write on
free:ed memory.
This can happen if eglDestroySurface() is called shortly after
eglSwapBuffers().
Note: This is a candidate for stable branches.
Reviewed-by: Kristian Høgsberg <[email protected]>
Diffstat (limited to 'src/gallium')
| -rw-r--r-- | src/gallium/state_trackers/egl/wayland/native_wayland.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/src/gallium/state_trackers/egl/wayland/native_wayland.c b/src/gallium/state_trackers/egl/wayland/native_wayland.c index 62c87f3b943..560e40d4cee 100644 --- a/src/gallium/state_trackers/egl/wayland/native_wayland.c +++ b/src/gallium/state_trackers/egl/wayland/native_wayland.c @@ -355,6 +355,9 @@ wayland_surface_destroy(struct native_surface *nsurf) wl_buffer_destroy(surface->buffer[buffer]); } + if (surface->frame_callback) + wl_callback_destroy(surface->frame_callback); + resource_surface_destroy(surface->rsurf); FREE(surface); } |