[PATCH] intel uxa: Fix use-after-free

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



white is set to src if used, but src can be used in the maskFormat too.
Fixes crash when logging in on a sandybridge laptop.

Signed-off-by: Maarten Lankhorst <maarten.lankhorst@xxxxxxxxxxxxx>

---

diff --git a/uxa/uxa-glyphs.c b/uxa/uxa-glyphs.c
index e83464e..4b81756 100644
--- a/uxa/uxa-glyphs.c
+++ b/uxa/uxa-glyphs.c
@@ -538,9 +538,6 @@ uxa_check_glyphs(CARD8 op,
 		list++;
 	}
 
-	if (white)
-		FreePicture(white, 0);
-
 	if (maskFormat) {
 		x = extents.x1;
 		y = extents.y1;
@@ -554,6 +551,9 @@ uxa_check_glyphs(CARD8 op,
 		FreeScratchPixmapHeader(scratch);
 		pixman_image_unref(image);
 	}
+
+	if (white)
+		FreePicture(white, 0);
 }
 
 static inline unsigned int


_______________________________________________
dri-devel mailing list
dri-devel@xxxxxxxxxxxxxxxxxxxxx
http://lists.freedesktop.org/mailman/listinfo/dri-devel


[Index of Archives]     [Linux DRI Users]     [Linux Intel Graphics]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]     [XFree86]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Linux Kernel]     [Linux SCSI]     [XFree86]
  Powered by Linux