Module: Mesa Branch: 10.5 Commit: d6413ed98fe07479d16cd2033d5379e06e5ce6d7 URL: http://cgit.freedesktop.org/mesa/mesa/commit/?id=d6413ed98fe07479d16cd2033d5379e06e5ce6d7
Author: Mario Kleiner <[email protected]> Date: Thu Mar 12 23:34:12 2015 +0100 mapi: Make private copies of name strings provided by client. glXGetProcAddress("glFoo") ends up in stub_add_dynamic() to create dynamic stubs for dynamic functions. stub_add_dynamic() doesn't store the caller provided name string "Foo" in a mesa private copy, but just stores a pointer to the "glFoo" string passed to glXGetProcAddress - a pointer into arbitrary memory outside mesa's control. If the caller passes some dynamically allocated/changing memory buffer to glXGetProcAddress(), or the caller gets unmapped from memory, e.g., some dynamically loaded application plugin which uses OpenGL, this ends badly - with a dangling pointer. strdup() the name string provided by the client to avoid this problem. Cc: "10.3 10.4 10.5" <[email protected]> Signed-off-by: Mario Kleiner <[email protected]> Reviewed-by: Brian Paul <[email protected]> (cherry picked from commit 1110113a7f0b6f9b21dd26dee8e95a021041c71c) --- src/mapi/stub.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/mapi/stub.c b/src/mapi/stub.c index dfadbe1..45ccc6a 100644 --- a/src/mapi/stub.c +++ b/src/mapi/stub.c @@ -110,7 +110,7 @@ stub_add_dynamic(const char *name) if (!stub->addr) return NULL; - stub->name = (const void *) name; + stub->name = (const void *) strdup(name); /* to be fixed later */ stub->slot = -1; _______________________________________________ mesa-commit mailing list [email protected] http://lists.freedesktop.org/mailman/listinfo/mesa-commit
