From 9f6e8e89c86d725fd0baa184af8a22f1f9032550 Mon Sep 17 00:00:00 2001 From: Michal Wajdeczko Date: Thu, 20 Mar 2008 17:38:12 -0700 Subject: intel: Use _mesa_ffs wrapper, and fix a use-after-free with INTEL_DEBUG=buf. --- src/mesa/drivers/dri/common/dri_bufmgr_fake.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) (limited to 'src/mesa/drivers/dri/common') diff --git a/src/mesa/drivers/dri/common/dri_bufmgr_fake.c b/src/mesa/drivers/dri/common/dri_bufmgr_fake.c index 8f67798a08..9d94ca3b39 100644 --- a/src/mesa/drivers/dri/common/dri_bufmgr_fake.c +++ b/src/mesa/drivers/dri/common/dri_bufmgr_fake.c @@ -231,7 +231,7 @@ alloc_block(dri_bo *bo) dri_bo_fake *bo_fake = (dri_bo_fake *)bo; dri_bufmgr_fake *bufmgr_fake= (dri_bufmgr_fake *)bo->bufmgr; struct block *block = (struct block *)calloc(sizeof *block, 1); - unsigned int align_log2 = ffs(bo_fake->alignment); + unsigned int align_log2 = _mesa_ffs(bo_fake->alignment); GLuint sz; if (!block) @@ -660,10 +660,12 @@ dri_fake_bo_unreference(dri_bo *bo) for (i = 0; i < bo_fake->nr_relocs; i++) dri_bo_unreference(bo_fake->relocs[i].target_buf); - free(bo_fake->relocs); + DBG("drm_bo_unreference: free buf %d %s\n", bo_fake->id, bo_fake->name); + + free(bo_fake->relocs); free(bo); - DBG("drm_bo_unreference: free %s\n", bo_fake->name); + return; } } @@ -924,6 +926,8 @@ dri_fake_emit_reloc(dri_bo *reloc_buf, uint64_t flags, GLuint delta, dri_bo_fake *reloc_fake = (dri_bo_fake *)reloc_buf; int i; + assert(reloc_buf); + assert(target_buf); if (reloc_fake->relocs == NULL) { reloc_fake->relocs = malloc(sizeof(struct fake_buffer_reloc) * MAX_RELOCS); -- cgit v1.2.3