diff options
| author | Michel Dänzer <michel.daenzer@amd.com> | 2016-12-16 18:05:58 +0900 |
|---|---|---|
| committer | Emil Velikov <emil.l.velikov@gmail.com> | 2017-01-24 01:13:22 +0000 |
| commit | 0b63515f2211337aeb74094b66d5ec5a7cabb0d3 (patch) | |
| tree | 8678bfc0c41c75378e26b33967ceca0c0603c7d9 /src/gallium/auxiliary | |
| parent | 02c3e9033e410f41601e5d862c8e8e09c968653f (diff) | |
cso: Don't restore nr_samplers in cso_restore_fragment_samplers
If info->nr_samplers > ctx->nr_fragment_samplers_saved, the assignment
would prevent cso_single_sampler_done from unbinding the no longer used
samplers from the driver, which could result in use-after-free. This is
probably unlikely to happen in practice though.
Cc: "12.0 13.0" <mesa-stable@lists.freedesktop.org>
Reviewed-by: Nicolai Hähnle <nicolai.haehnle@amd.com>
(cherry picked from commit 3d661a12be5be95da929b19cf4b5976b3c3fb8e9)
Diffstat (limited to 'src/gallium/auxiliary')
| -rw-r--r-- | src/gallium/auxiliary/cso_cache/cso_context.c | 1 |
1 files changed, 0 insertions, 1 deletions
diff --git a/src/gallium/auxiliary/cso_cache/cso_context.c b/src/gallium/auxiliary/cso_cache/cso_context.c index 127e0711c20..2ee87f91848 100644 --- a/src/gallium/auxiliary/cso_cache/cso_context.c +++ b/src/gallium/auxiliary/cso_cache/cso_context.c @@ -1275,7 +1275,6 @@ cso_restore_fragment_samplers(struct cso_context *ctx) { struct sampler_info *info = &ctx->samplers[PIPE_SHADER_FRAGMENT]; - info->nr_samplers = ctx->nr_fragment_samplers_saved; memcpy(info->samplers, ctx->fragment_samplers_saved, sizeof(info->samplers)); cso_single_sampler_done(ctx, PIPE_SHADER_FRAGMENT); |