From bf95436d98ef743f4b2ade46243679e0b98a2a5a Mon Sep 17 00:00:00 2001 From: Ian Romanick Date: Wed, 26 Sep 2012 17:57:01 -0700 Subject: [PATCH 3/3] i915: Don't leave dangling pointer to i915 context on failure Otherwise intelDestroyContext would try to dereference the pointer to freed memory. NOTE: This is a candidate for the 9.0 branch. Signed-off-by: Ian Romanick Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=53618 --- src/mesa/drivers/dri/i915/i915_context.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/src/mesa/drivers/dri/i915/i915_context.c b/src/mesa/drivers/dri/i915/i915_context.c index 8ae1e58..82bd3e0 100644 --- a/src/mesa/drivers/dri/i915/i915_context.c +++ b/src/mesa/drivers/dri/i915/i915_context.c @@ -167,9 +167,8 @@ i915CreateContext(int api, if (!intelInitContext(intel, api, mesaVis, driContextPriv, sharedContextPrivate, &functions)) { - free(i915); *error = __DRI_CTX_ERROR_NO_MEMORY; - return false; + goto error; } /* Now that the extension bits are known, filter against the requested API @@ -184,8 +183,7 @@ i915CreateContext(int api, if (req_version > max_version) { *error = __DRI_CTX_ERROR_BAD_VERSION; - free(i915); - return false; + goto error; } break; } @@ -194,8 +192,7 @@ i915CreateContext(int api, break; default: *error = __DRI_CTX_ERROR_BAD_API; - free(i915); - return false; + goto error; } intel_init_texture_formats(ctx); @@ -299,4 +296,9 @@ i915CreateContext(int api, _tnl_allow_pixel_fog(ctx, 1); return true; + +error: + ralloc_free(i915); + driContextPriv->driverPrivate = NULL; + return false; } -- 1.7.11.4