aboutsummaryrefslogtreecommitdiffstats
path: root/src
diff options
context:
space:
mode:
authorBrian Paul <[email protected]>2014-09-12 06:29:04 -0600
committerBrian Paul <[email protected]>2014-09-12 09:17:31 -0600
commit0d73ac6b02cac46d4a8f3cd1ffa591e071577fa7 (patch)
tree905dd8479127949f9d4d15d9e6753c37219ef842 /src
parent2828680e39e843514a38781878e2a3534f876233 (diff)
mesa: fix _mesa_free_pipeline_data() use-after-free bug
Unreference the ctx->_Shader object before we delete all the pipeline objects in the hash table. Before, ctx->_Shader could point to freed memory when _mesa_reference_pipeline_object(ctx, &ctx->_Shader, NULL) was called. Fixes crash when exiting the piglit rendezvous_by_location test on Windows. Cc: [email protected] Reviewed-by: Ian Romanick <[email protected]>
Diffstat (limited to 'src')
-rw-r--r--src/mesa/main/pipelineobj.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/src/mesa/main/pipelineobj.c b/src/mesa/main/pipelineobj.c
index 017d4257eb8..b713d956f78 100644
--- a/src/mesa/main/pipelineobj.c
+++ b/src/mesa/main/pipelineobj.c
@@ -120,12 +120,12 @@ delete_pipelineobj_cb(GLuint id, void *data, void *userData)
void
_mesa_free_pipeline_data(struct gl_context *ctx)
{
+ _mesa_reference_pipeline_object(ctx, &ctx->_Shader, NULL);
+
_mesa_HashDeleteAll(ctx->Pipeline.Objects, delete_pipelineobj_cb, ctx);
_mesa_DeleteHashTable(ctx->Pipeline.Objects);
- _mesa_reference_pipeline_object(ctx, &ctx->_Shader, NULL);
_mesa_delete_pipeline_object(ctx, ctx->Pipeline.Default);
-
}
/**