fix the potential memory corruption 82/163582/2
authorBoram Park <boram1288.park@samsung.com>
Tue, 12 Dec 2017 07:17:32 +0000 (16:17 +0900)
committerBoram Park <boram1288.park@samsung.com>
Tue, 12 Dec 2017 23:20:17 +0000 (08:20 +0900)
Changing the initted address of a variable in the middle of a function running
is very dangerous. If it happens suddenly, it could make unexpected result and
must be hard to debug.

Change-Id: I55a489d490876ec2992b7949da8e2596f91644b6

src/tbm_bufmgr_vc4.c

index f963101..22209a6 100644 (file)
@@ -1027,7 +1027,7 @@ tbm_vc4_bo_alloc(tbm_bo bo, int size, int flags)
 static void
 tbm_vc4_bo_free(tbm_bo bo)
 {
-       tbm_bo_vc4 bo_vc4;
+       tbm_bo_vc4 bo_vc4, temp;
        tbm_bufmgr_vc4 bufmgr_vc4;
 
        if (!bo)
@@ -1062,7 +1062,7 @@ tbm_vc4_bo_free(tbm_bo bo)
        int ret;
 
        ret = drmHashLookup(bufmgr_vc4->hashBos, bo_vc4->name,
-                            (void **)&bo_vc4);
+                            (void **)&temp);
        if (ret == 0) {
                drmHashDelete(bufmgr_vc4->hashBos, bo_vc4->name);
        } else {
@@ -1070,6 +1070,9 @@ tbm_vc4_bo_free(tbm_bo bo)
                        bo_vc4->name, ret);
        }
 
+       if (temp != bo_vc4)
+               TBM_VC4_ERROR("hashBos probably has several BOs with same name!!!\n");
+
        _bo_destroy_cache_state(bufmgr_vc4, bo_vc4);
 
        /* Free gem handle */