diff options
| author | Brian Paul <brianp@vmware.com> | 2014-05-15 15:49:14 -0600 |
|---|---|---|
| committer | Carl Worth <cworth@cworth.org> | 2014-05-16 16:07:30 -0700 |
| commit | 07ada102cba0e9f0b826cc4cdad0a1398274d6b2 (patch) | |
| tree | 9c742686e3ed794d093175d29f4e61ce6fb17cd0 | |
| parent | 13b142a42053b7aa0c5bc8df69c6e0d7b5f2085d (diff) | |
mesa: fix double-freeing of dispatch tables inside glBegin/End.
We allocate dispatch tables for BeginEnd and OutsideBeginEnd. But
when we destroy the context we were freeing the BeginEnd and Exec
tables. If Exec==BeginEnd we did a double-free. This would happen
if the context was destroyed while inside a glBegin/End pair. Now
free the BeginEnd and OutsideBeginEnd pointers.
Cc: "10.1", "10.2" <mesa-stable@lists.freedesktop.org>
Reviewed-by: Michel Dänzer <michel.daenzer@amd.com>
(cherry picked from commit ef6b6658f91bd5871739bdb71a08042f26abe389)
| -rw-r--r-- | src/mesa/main/context.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/src/mesa/main/context.c b/src/mesa/main/context.c index b818ab41a6b..dcd319b0402 100644 --- a/src/mesa/main/context.c +++ b/src/mesa/main/context.c @@ -1112,7 +1112,7 @@ _mesa_initialize_context(struct gl_context *ctx, fail: _mesa_reference_shared_state(ctx, &ctx->Shared, NULL); free(ctx->BeginEnd); - free(ctx->Exec); + free(ctx->OutsideBeginEnd); free(ctx->Save); return GL_FALSE; } @@ -1213,7 +1213,7 @@ _mesa_free_context_data( struct gl_context *ctx ) /* free dispatch tables */ free(ctx->BeginEnd); - free(ctx->Exec); + free(ctx->OutsideBeginEnd); free(ctx->Save); /* Shared context state (display lists, textures, etc) */ |