tpl_wl_vk_thread: Fixed bug to prevent heap-buffer-overflow.

Change-Id: I991585fd99975196715d98a23b83603f4f20bf62
Signed-off-by: Joonbum Ko <joonbum.ko@samsung.com>

diff --git a/src/tpl_wl_vk_thread.c b/src/tpl_wl_vk_thread.c
index 96ac5da44388fb1a5cb96dcf4026fe66db8c58b2..43f5a847b3758b47b0513a8d79359a9c09c9f5c0 100644 (file)
--- a/src/tpl_wl_vk_thread.c
+++ b/src/tpl_wl_vk_thread.c
@@ -651,24 +651,26 @@ __tpl_wl_vk_wsi_surface_create_swapchain(tpl_surface_t *surface,
                                          old_width, old_height, width, height);
                }
 
-               wayland_vk_wsi_surface->buffer_count =
-                       tbm_surface_queue_get_size(wayland_vk_wsi_surface->tbm_queue);
-               wayland_vk_wsi_surface->reset = TPL_FALSE;
-
-               __tpl_util_atomic_inc(&wayland_vk_wsi_surface->swapchain_reference);
-
                if (wayland_vk_wsi_surface->swapchain_buffers) {
                        int i;
                        for (i = 0; i < wayland_vk_wsi_surface->buffer_count; i++) {
-                               TPL_DEBUG("unref tbm_surface(%p)", wayland_vk_wsi_surface->swapchain_buffers[i]);
-                               tbm_surface_internal_unref(wayland_vk_wsi_surface->swapchain_buffers[i]);
-                               wayland_vk_wsi_surface->swapchain_buffers[i] = NULL;
+                               if (wayland_vk_wsi_surface->swapchain_buffers[i]) {
+                                       TPL_DEBUG("unref tbm_surface(%p)", wayland_vk_wsi_surface->swapchain_buffers[i]);
+                                       tbm_surface_internal_unref(wayland_vk_wsi_surface->swapchain_buffers[i]);
+                                       wayland_vk_wsi_surface->swapchain_buffers[i] = NULL;
+                               }
                        }
 
                        free(wayland_vk_wsi_surface->swapchain_buffers);
                        wayland_vk_wsi_surface->swapchain_buffers = NULL;
                }
 
+               wayland_vk_wsi_surface->buffer_count =
+                       tbm_surface_queue_get_size(wayland_vk_wsi_surface->tbm_queue);
+               wayland_vk_wsi_surface->reset = TPL_FALSE;
+
+               __tpl_util_atomic_inc(&wayland_vk_wsi_surface->swapchain_reference);
+
                TPL_LOG_T("WL_VK", "[REUSE] wayland_vk_wsi_surface(%p) tbm_queue(%p) size(%d)",
                                  wayland_vk_wsi_surface, wayland_vk_wsi_surface->tbm_queue,
                                  wayland_vk_wsi_surface->buffer_count);