From c28707b50701b1cf8727be29d61e2d939c6ee58f Mon Sep 17 00:00:00 2001 From: Michel Dänzer Date: Thu, 30 Apr 2009 13:21:08 +0200 Subject: r300: Increase reference count of texture objects referenced by current state. Fixes a use-after-free reported in http://bugs.freedesktop.org/show_bug.cgi?id=20539, so this possibly fixes that bug. It has been confirmed to fix http://bugs.freedesktop.org/show_bug.cgi?id=17895 . --- src/mesa/drivers/dri/r300/r300_state.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'src/mesa/drivers/dri/r300/r300_state.c') diff --git a/src/mesa/drivers/dri/r300/r300_state.c b/src/mesa/drivers/dri/r300/r300_state.c index 6b79aa4313..79f0b3625c 100644 --- a/src/mesa/drivers/dri/r300/r300_state.c +++ b/src/mesa/drivers/dri/r300/r300_state.c @@ -1362,7 +1362,7 @@ static void r300SetupTextures(GLcontext * ctx) #endif tmu_mappings[i] = hw_tmu; - t = r300->state.texture.unit[i].texobj; + t = (r300TexObjPtr) r300->state.texture.unit[i].texobj->DriverData; /* XXX questionable fix for bug 9170: */ if (!t) continue; -- cgit v1.2.3