intel uxa: Fix use-after-free

PATCH New Maarten Lankhorst 1 participant 1 message Jun 19, 2012

Share & tools

Maarten Lankhorst

author

2012-06-19 15:53 UTC #0 lore raw

PATCH 1/1 intel uxa: Fix use-after-free

white is set to src if used, but src can be used in the maskFormat too. Fixes crash when logging in on a sandybridge laptop.

Signed-off-by Maarten Lankhorst <[email protected]>

---

uxa/uxa-glyphs.c +3 -3

index e83464e..4b81756 100644
@@ -538,9 +538,6 @@ uxa_check_glyphs(CARD8 op,
 		list++;
 	}
 
-	if (white)
-		FreePicture(white, 0);
-
 	if (maskFormat) {
 		x = extents.x1;
 		y = extents.y1;

@@ -554,6 +551,9 @@ uxa_check_glyphs(CARD8 op,
 		FreeScratchPixmapHeader(scratch);
 		pixman_image_unref(image);
 	}
+
+	if (white)
+		FreePicture(white, 0);
 }
 
 static inline unsigned int