summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorThomas Hindoe Paaboel Andersen <phomes@gmail.com>2016-03-05 13:07:07 +0100
committerEmil Velikov <emil.l.velikov@gmail.com>2016-05-04 15:55:34 +0100
commitcf1a04c414e4a31349f85fc84c24053029f7be34 (patch)
tree0eee1500fd45cbdb7b6b65f3a8d9e30634a4ab88
parent58a7d3cfcb7b812dc247e792a7bb166fdc0ac05d (diff)
st/va: avoid dereference after free in vlVaDestroyImage
Cc: "11.1 11.2" <mesa-stable@lists.freedesktop.org> Reviewed-by: Emil Velikov <emil.l.velikov@gmail.com> Tested-by: Julien Isorce <j.isorce@samsung.com> (cherry picked from commit b9855dcdf7c94605305d6372d1f9883f76d10b6a) Fixes: 05e225b558a ("st/va: added internal storage for VAImage and BGRA format") [Emil Velikov: Add fixes tag, resolve merge conflicts] Signed-off-by: Emil Velikov <emil.velikov@collabora.com> Conflicts: src/gallium/state_trackers/va/image.c
-rw-r--r--src/gallium/state_trackers/va/image.c4
1 files changed, 3 insertions, 1 deletions
diff --git a/src/gallium/state_trackers/va/image.c b/src/gallium/state_trackers/va/image.c
index ae07da857e1..0ccc7eaf2bb 100644
--- a/src/gallium/state_trackers/va/image.c
+++ b/src/gallium/state_trackers/va/image.c
@@ -281,6 +281,7 @@ VAStatus
vlVaDestroyImage(VADriverContextP ctx, VAImageID image)
{
VAImage *vaimage;
+ VAStatus status;
if (!ctx)
return VA_STATUS_ERROR_INVALID_CONTEXT;
@@ -290,8 +291,9 @@ vlVaDestroyImage(VADriverContextP ctx, VAImageID image)
return VA_STATUS_ERROR_INVALID_IMAGE;
handle_table_remove(VL_VA_DRIVER(ctx)->htab, image);
+ status = vlVaDestroyBuffer(ctx, vaimage->buf);
FREE(vaimage);
- return vlVaDestroyBuffer(ctx, vaimage->buf);
+ return status;
}
VAStatus