evas: fix use after free.

Thanks to Thanatermesis for tracking this in T2135.

diff --git a/src/modules/evas/engines/gl_common/evas_gl_image.c b/src/modules/evas/engines/gl_common/evas_gl_image.c
index b8076a0..ff415ba 100644 (file)
--- a/src/modules/evas/engines/gl_common/evas_gl_image.c
+++ b/src/modules/evas/engines/gl_common/evas_gl_image.c
@@ -770,9 +770,11 @@ evas_gl_common_image_update(Evas_Engine_GL_Context *gc, Evas_GL_Image *im)
 {
    Image_Entry *ie;
    if (!im->im) return;
-   ie = &im->im->cache_entry;
    evas_gl_common_image_alloc_ensure(im);
 
+   // alloc ensure can change im->im, so only get the local variable later.
+   ie = &im->im->cache_entry;
+
 /*
    if ((im->cs.space == EVAS_COLORSPACE_YCBCR422P601_PL) ||
        (im->cs.space == EVAS_COLORSPACE_YCBCR422P709_PL))