summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorBrian Paul <brianp@vmware.com>2014-05-15 15:49:14 -0600
committerBrian Paul <brianp@vmware.com>2014-05-16 07:14:57 -0600
commitef6b6658f91bd5871739bdb71a08042f26abe389 (patch)
tree5eeb0ac83b2b5c0f9fcd8429c74835a3db89a8a1
parent730bc124c39f4a2ed9fea53959676bca150ae4d3 (diff)
mesa: fix double-freeing of dispatch tables inside glBegin/End.
We allocate dispatch tables for BeginEnd and OutsideBeginEnd. But when we destroy the context we were freeing the BeginEnd and Exec tables. If Exec==BeginEnd we did a double-free. This would happen if the context was destroyed while inside a glBegin/End pair. Now free the BeginEnd and OutsideBeginEnd pointers. Cc: "10.1", "10.2" <mesa-stable@lists.freedesktop.org> Reviewed-by: Michel Dänzer <michel.daenzer@amd.com>
-rw-r--r--src/mesa/main/context.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/src/mesa/main/context.c b/src/mesa/main/context.c
index 860ae860531..8eb426d5904 100644
--- a/src/mesa/main/context.c
+++ b/src/mesa/main/context.c
@@ -1141,7 +1141,7 @@ _mesa_initialize_context(struct gl_context *ctx,
fail:
_mesa_reference_shared_state(ctx, &ctx->Shared, NULL);
free(ctx->BeginEnd);
- free(ctx->Exec);
+ free(ctx->OutsideBeginEnd);
free(ctx->Save);
return GL_FALSE;
}
@@ -1242,7 +1242,7 @@ _mesa_free_context_data( struct gl_context *ctx )
/* free dispatch tables */
free(ctx->BeginEnd);
- free(ctx->Exec);
+ free(ctx->OutsideBeginEnd);
free(ctx->Save);
/* Shared context state (display lists, textures, etc) */