gallium/osmesa: fix buffer resizing
authormattvchandler <tardarsauce@gmail.com>
Wed, 1 Sep 2021 17:44:12 +0000 (09:44 -0800)
committerMarge Bot <eric+marge@anholt.net>
Fri, 3 Sep 2021 20:30:04 +0000 (20:30 +0000)
Generate a new buffer if OSMesaMakeCurrent is called with a new size
Fix a use-after-free error when the old buffer is destroyed

Closes: https://gitlab.freedesktop.org/mesa/mesa/-/issues/5276
Fixes: 26c6f6cfbb6 ("gallium/osmesa: Remove the broken buffer-reuse scheme.")
Reviewed-by: Emma Anholt <emma@anholt.net>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/12685>

src/gallium/frontends/osmesa/osmesa.c

index 9638889..91a250d 100644 (file)
@@ -781,8 +781,11 @@ OSMesaMakeCurrent(OSMesaContext osmesa, void *buffer, GLenum type,
    if (osmesa->current_buffer &&
        (osmesa->current_buffer->visual.color_format != color_format ||
         osmesa->current_buffer->visual.depth_stencil_format != osmesa->depth_stencil_format ||
-        osmesa->current_buffer->visual.accum_format != osmesa->accum_format)) {
+        osmesa->current_buffer->visual.accum_format != osmesa->accum_format ||
+        osmesa->current_buffer->width != width ||
+        osmesa->current_buffer->height != height)) {
       osmesa_destroy_buffer(osmesa->current_buffer);
+      osmesa->current_buffer = NULL;
    }
 
    if (!osmesa->current_buffer) {