From: Boram Park <boram1288.park@samsung.com>
Date: Tue, 12 Dec 2017 07:17:32 +0000 (+0900)
Subject: fix the potential memory corruption
X-Git-Tag: submit/tizen/20171213.005922~1
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=11785c5e414c05167dbca2561626b23bafb10ee1;p=platform%2Fadaptation%2Fbroadcom%2Flibtbm-vc4.git

fix the potential memory corruption

Changing the initted address of a variable in the middle of a function running
is very dangerous. If it happens suddenly, it could make unexpected result and
must be hard to debug.

Change-Id: I55a489d490876ec2992b7949da8e2596f91644b6
---

diff --git a/src/tbm_bufmgr_vc4.c b/src/tbm_bufmgr_vc4.c
index f963101..22209a6 100644
--- a/src/tbm_bufmgr_vc4.c
+++ b/src/tbm_bufmgr_vc4.c
@@ -1027,7 +1027,7 @@ tbm_vc4_bo_alloc(tbm_bo bo, int size, int flags)
 static void
 tbm_vc4_bo_free(tbm_bo bo)
 {
-	tbm_bo_vc4 bo_vc4;
+	tbm_bo_vc4 bo_vc4, temp;
 	tbm_bufmgr_vc4 bufmgr_vc4;
 
 	if (!bo)
@@ -1062,7 +1062,7 @@ tbm_vc4_bo_free(tbm_bo bo)
 	int ret;
 
 	ret = drmHashLookup(bufmgr_vc4->hashBos, bo_vc4->name,
-			     (void **)&bo_vc4);
+			     (void **)&temp);
 	if (ret == 0) {
 		drmHashDelete(bufmgr_vc4->hashBos, bo_vc4->name);
 	} else {
@@ -1070,6 +1070,9 @@ tbm_vc4_bo_free(tbm_bo bo)
 			bo_vc4->name, ret);
 	}
 
+	if (temp != bo_vc4)
+		TBM_VC4_ERROR("hashBos probably has several BOs with same name!!!\n");
+
 	_bo_destroy_cache_state(bufmgr_vc4, bo_vc4);
 
 	/* Free gem handle */