|
The symbol_header structure that tracks symbols with a particular name
may have a different (longer) life time than the symbols it tracks.
Not keeping a local copy of the name can lead to use-after-free
errors. For example, the following sequence would trigger such an
error:
char *copy = strdup(name);
_mesa_symbol_table_push_scope(st);
_mesa_symbol_table_add_symbol(st, 0, name, NULL);
_mesa_symbol_table_pop_scope(st);
free(name);
_mesa_symbol_table_find_symbol(st, 0, copy);
With this change, the symbol table keeps a local copy of the name that
has the same life time as the symbol_header for that name. This
resolves some use-after-free errors with built-in functions in the
GLSL compiler.
|