glsl: fix several use-after-free bugs
authorBrian Paul <brianp@vmware.com>
Fri, 17 Oct 2014 19:31:53 +0000 (13:31 -0600)
committerBrian Paul <brianp@vmware.com>
Mon, 20 Oct 2014 14:59:32 +0000 (08:59 -0600)
commit14379a0644ed69c5b7a6c6150ae91eba6f316e33
tree8a40d61d34427a581a645b76ee71d4553cda314f
parent953a0af8e3f73ce0a42a5dc2bf25355453d7a7b0
glsl: fix several use-after-free bugs

The get_variable_being_redeclared() function can free the 'var' argument.
Thereafter, we cannot assume that 'var' is a valid  pointer.  This patch
replaces 'var->name' with 'earlier->name' in two places and calls
is_gl_identifier(var->name) before 'var' might get freed.

This fixes several piglit GLSL crashes, including:
spec/glsl-1.50/execution/geometry/clip-distance-in-param
spec/glsl-1.50/execution/geometry/clip-distance-bulk-copy
spec/glsl-1.50/compiler/gs-redeclares-pervertex-out-before-global-redeclaration.geom

I'm not sure why these were not spotted sooner.
A similar bug was previously fixed by f9cecca7a.

Cc: <mesa-stable@lists.freedesktop.org>
Reviewed-by: Chris Forbes <chrisf@ijw.co.nz>
src/glsl/ast_to_hir.cpp