From: Michel Dänzer <[email protected]> Otherwise the DRI2Drawable may retain references to the destroyed __GLXDRIdrawable, leading to use after free in __glXDRIinvalidateBuffers().
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=50019 Signed-off-by: Michel Dänzer <[email protected]> --- glx/glxdri2.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/glx/glxdri2.c b/glx/glxdri2.c index 7b76c3a..3012cb5 100644 --- a/glx/glxdri2.c +++ b/glx/glxdri2.c @@ -597,7 +597,7 @@ __glXDRIscreenCreateDrawable(ClientPtr client, private->base.waitGL = __glXDRIdrawableWaitGL; private->base.waitX = __glXDRIdrawableWaitX; - if (DRI2CreateDrawable(client, pDraw, drawId, + if (DRI2CreateDrawable(client, pDraw, glxDrawId, __glXDRIinvalidateBuffers, private)) { free(private); return NULL; -- 1.7.10 _______________________________________________ [email protected]: X.Org development Archives: http://lists.x.org/archives/xorg-devel Info: http://lists.x.org/mailman/listinfo/xorg-devel
