diff options
| author | Brian Paul <brianp@vmware.com> | 2014-05-23 14:59:33 -0600 |
|---|---|---|
| committer | Ian Romanick <ian.d.romanick@intel.com> | 2014-05-29 15:48:02 -0700 |
| commit | 55b9effa4a23755232e433d3da4f422a1f74fd82 (patch) | |
| tree | 1a3359271a618953a52bd0df84b0cd6f9579517c | |
| parent | 5347fc529537a52d2cebee64f7ea0f2b10dd17ab (diff) | |
glsl: fix use-after free bug/crash in ast_declarator_list::hir()
The call to get_variable_being_redeclared() may delete 'var' so we
can't reference var->name afterward. We fix that by examining the
var's name before making that call.
Fixes valgrind warnings and possible crash when running the piglit
tests/spec/glsl-1.30/execution/clipping/vs-clip-distance-in-param.shader_test
test (and probably others).
Cc: "10.1 10.2" <mesa-stable@lists.freedesktop.org>
Reviewed-by: Ian Romanick <ian.d.romanick@intel.com>
(cherry picked from commit f9cecca7a6e3d9ff231075381b88d179e153a5a4)
| -rw-r--r-- | src/glsl/ast_to_hir.cpp | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/src/glsl/ast_to_hir.cpp b/src/glsl/ast_to_hir.cpp index 7516c33e1df..332f934fff4 100644 --- a/src/glsl/ast_to_hir.cpp +++ b/src/glsl/ast_to_hir.cpp @@ -3652,11 +3652,15 @@ ast_declarator_list::hir(exec_list *instructions, * instruction stream. */ exec_list initializer_instructions; + + /* Examine var name here since var may get deleted in the next call */ + bool var_is_gl_id = (strncmp(var->name, "gl_", 3) == 0); + ir_variable *earlier = get_variable_being_redeclared(var, decl->get_location(), state, false /* allow_all_redeclarations */); if (earlier != NULL) { - if (strncmp(var->name, "gl_", 3) == 0 && + if (var_is_gl_id && earlier->data.how_declared == ir_var_declared_in_block) { _mesa_glsl_error(&loc, state, "`%s' has already been redeclared using " |