mesa: fix double-freeing of dispatch tables inside glBegin/End.
We allocate dispatch tables for BeginEnd and OutsideBeginEnd. But when we destroy the context we were freeing the BeginEnd and Exec tables. If Exec==BeginEnd we did a double-free. This would happen if the context was destroyed while inside a glBegin/End pair. Now free the BeginEnd and OutsideBeginEnd pointers. Cc: "10.1", "10.2" <mesa-stable@lists.freedesktop.org> Reviewed-by: Michel Dänzer <michel.daenzer@amd.com>
This commit is contained in:
parent
730bc124c3
commit
ef6b6658f9
|
@ -1141,7 +1141,7 @@ _mesa_initialize_context(struct gl_context *ctx,
|
|||
fail:
|
||||
_mesa_reference_shared_state(ctx, &ctx->Shared, NULL);
|
||||
free(ctx->BeginEnd);
|
||||
free(ctx->Exec);
|
||||
free(ctx->OutsideBeginEnd);
|
||||
free(ctx->Save);
|
||||
return GL_FALSE;
|
||||
}
|
||||
|
@ -1242,7 +1242,7 @@ _mesa_free_context_data( struct gl_context *ctx )
|
|||
|
||||
/* free dispatch tables */
|
||||
free(ctx->BeginEnd);
|
||||
free(ctx->Exec);
|
||||
free(ctx->OutsideBeginEnd);
|
||||
free(ctx->Save);
|
||||
|
||||
/* Shared context state (display lists, textures, etc) */
|
||||
|
|
Loading…
Reference in New Issue