From cf1a04c414e4a31349f85fc84c24053029f7be34 Mon Sep 17 00:00:00 2001
From: Thomas Hindoe Paaboel Andersen <phomes@gmail.com>
Date: Sat, 5 Mar 2016 13:07:07 +0100
Subject: st/va: avoid dereference after free in vlVaDestroyImage

Cc: "11.1 11.2" <mesa-stable@lists.freedesktop.org>
Reviewed-by: Emil Velikov <emil.l.velikov@gmail.com>
Tested-by: Julien Isorce <j.isorce@samsung.com>
(cherry picked from commit b9855dcdf7c94605305d6372d1f9883f76d10b6a)

Fixes: 05e225b558a ("st/va: added internal storage for VAImage and BGRA
format")
[Emil Velikov: Add fixes tag, resolve merge conflicts]
Signed-off-by: Emil Velikov <emil.velikov@collabora.com>

Conflicts:
	src/gallium/state_trackers/va/image.c
---
 src/gallium/state_trackers/va/image.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/gallium/state_trackers/va/image.c b/src/gallium/state_trackers/va/image.c
index ae07da857e1..0ccc7eaf2bb 100644
--- a/src/gallium/state_trackers/va/image.c
+++ b/src/gallium/state_trackers/va/image.c
@@ -281,6 +281,7 @@ VAStatus
 vlVaDestroyImage(VADriverContextP ctx, VAImageID image)
 {
    VAImage  *vaimage;
+   VAStatus status;
 
    if (!ctx)
       return VA_STATUS_ERROR_INVALID_CONTEXT;
@@ -290,8 +291,9 @@ vlVaDestroyImage(VADriverContextP ctx, VAImageID image)
       return VA_STATUS_ERROR_INVALID_IMAGE;
 
    handle_table_remove(VL_VA_DRIVER(ctx)->htab, image);
+   status = vlVaDestroyBuffer(ctx, vaimage->buf);
    FREE(vaimage);
-   return vlVaDestroyBuffer(ctx, vaimage->buf);
+   return status;
 }
 
 VAStatus
-- 
cgit v1.2.3