diff options
| author | Michel Dänzer <daenzer@vmware.com> | 2009-04-30 13:21:08 +0200 |
|---|---|---|
| committer | Michel Dänzer <daenzer@vmware.com> | 2009-04-30 13:50:36 +0200 |
| commit | a1ce4efefbb7f796a0a24544a1e893a56848f0c1 (patch) | |
| tree | e508b917e3cb91ac0fd5242a12b5cdfbc1d69da9 /src/mesa/drivers/dri/r300/r300_state.c | |
| parent | 656cd707db3699079d3a1b886d82e6f04afb1065 (diff) | |
r300: Increase reference count of texture objects referenced by current state.
Fixes a use-after-free reported in
http://bugs.freedesktop.org/show_bug.cgi?id=20539, so this possibly fixes that
bug. It has been confirmed to fix
http://bugs.freedesktop.org/show_bug.cgi?id=17895 .
(cherry picked from commit c28707b50701b1cf8727be29d61e2d939c6ee58f)
Diffstat (limited to 'src/mesa/drivers/dri/r300/r300_state.c')
| -rw-r--r-- | src/mesa/drivers/dri/r300/r300_state.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/mesa/drivers/dri/r300/r300_state.c b/src/mesa/drivers/dri/r300/r300_state.c index b756d1cc204..de4063a0630 100644 --- a/src/mesa/drivers/dri/r300/r300_state.c +++ b/src/mesa/drivers/dri/r300/r300_state.c @@ -1487,7 +1487,7 @@ static void r300SetupTextures(GLcontext * ctx) #endif tmu_mappings[i] = hw_tmu; - t = r300->state.texture.unit[i].texobj; + t = (r300TexObjPtr) r300->state.texture.unit[i].texobj->DriverData; /* XXX questionable fix for bug 9170: */ if (!t) continue; |