diff options
| author | Michel Dänzer <daenzer@vmware.com> | 2009-04-30 13:21:08 +0200 |
|---|---|---|
| committer | Michel Dänzer <daenzer@vmware.com> | 2009-04-30 13:21:08 +0200 |
| commit | c28707b50701b1cf8727be29d61e2d939c6ee58f (patch) | |
| tree | 97266614c6e162f4730427c2e4e33f547fcd9def /src/mesa/drivers/dri/r300/r300_texstate.c | |
| parent | ba27fe3710af4933a16278a3e97162bef1737b56 (diff) | |
r300: Increase reference count of texture objects referenced by current state.
Fixes a use-after-free reported in
http://bugs.freedesktop.org/show_bug.cgi?id=20539, so this possibly fixes that
bug. It has been confirmed to fix
http://bugs.freedesktop.org/show_bug.cgi?id=17895 .
Diffstat (limited to 'src/mesa/drivers/dri/r300/r300_texstate.c')
| -rw-r--r-- | src/mesa/drivers/dri/r300/r300_texstate.c | 11 |
1 files changed, 6 insertions, 5 deletions
diff --git a/src/mesa/drivers/dri/r300/r300_texstate.c b/src/mesa/drivers/dri/r300/r300_texstate.c index cadec7f3ec..abe613e27b 100644 --- a/src/mesa/drivers/dri/r300/r300_texstate.c +++ b/src/mesa/drivers/dri/r300/r300_texstate.c @@ -567,19 +567,20 @@ static GLboolean r300UpdateTexture(GLcontext * ctx, int unit) /* Update state if this is a different texture object to last * time. */ - if (rmesa->state.texture.unit[unit].texobj != t) { + if (rmesa->state.texture.unit[unit].texobj != tObj) { if (rmesa->state.texture.unit[unit].texobj != NULL) { + r300TexObjPtr t_old = (r300TexObjPtr) rmesa->state.texture.unit[unit].texobj->DriverData; + /* The old texture is no longer bound to this texture unit. * Mark it as such. */ - rmesa->state.texture.unit[unit].texobj->base.bound &= - ~(1 << unit); + t_old->base.bound &= ~(1 << unit); } - rmesa->state.texture.unit[unit].texobj = t; + _mesa_reference_texobj(&rmesa->state.texture.unit[unit].texobj, tObj); t->base.bound |= (1 << unit); - driUpdateTextureLRU((driTextureObject *) t); /* XXX: should be locked! */ + driUpdateTextureLRU(&t->base); /* XXX: should be locked! */ } return !t->border_fallback; |