From 066bee64e1611093c7e641ba77bbd43f70d08cec Mon Sep 17 00:00:00 2001 From: Eric Anholt Date: Wed, 6 Jul 2011 11:31:00 -0700 Subject: [PATCH] intel: Fix use of freed buffer if glBitmap is called after a swap. Regions looked up from the framebuffer are invalid after intel_prepare_render(). Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=30266 Tested-by: Thomas Jones --- src/mesa/drivers/dri/intel/intel_pixel_bitmap.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/src/mesa/drivers/dri/intel/intel_pixel_bitmap.c b/src/mesa/drivers/dri/intel/intel_pixel_bitmap.c index 64c7acc..86d0ef2 100644 --- a/src/mesa/drivers/dri/intel/intel_pixel_bitmap.c +++ b/src/mesa/drivers/dri/intel/intel_pixel_bitmap.c @@ -175,7 +175,7 @@ do_blit_bitmap( struct gl_context *ctx, const GLubyte *bitmap ) { struct intel_context *intel = intel_context(ctx); - struct intel_region *dst = intel_drawbuf_region(intel); + struct intel_region *dst; struct gl_framebuffer *fb = ctx->DrawBuffer; GLfloat tmpColor[4]; GLubyte ubcolor[4]; @@ -198,6 +198,9 @@ do_blit_bitmap( struct gl_context *ctx, return GL_FALSE; } + intel_prepare_render(intel); + dst = intel_drawbuf_region(intel); + if (!dst) return GL_FALSE; @@ -226,8 +229,6 @@ do_blit_bitmap( struct gl_context *ctx, if (!intel_check_blit_fragment_ops(ctx, tmpColor[3] == 1.0F)) return GL_FALSE; - intel_prepare_render(intel); - /* Clip to buffer bounds and scissor. */ if (!_mesa_clip_to_region(fb->_Xmin, fb->_Ymin, fb->_Xmax, fb->_Ymax, -- 2.7.4