From a27c6e1aea1d048e0c701ca59c3c5bcf12b69d7b Mon Sep 17 00:00:00 2001 From: Ian Romanick Date: Fri, 12 Apr 2013 16:47:52 -0700 Subject: [PATCH] mesa/swrast: Move free calls outside the attachment loop This was originally discovered by Klocwork analysis: Possible memory leak. Dynamic memory stored in 'srcBuffer0' allocated through function 'malloc' at line 566 can be lost at line 746 However, I think the problem is actually much worse. Since the memory is freed after the first pass through the loop, the released buffer may be used on the next iteration! NOTE: This is a candidate for stable release branches. Signed-off-by: Ian Romanick Reviewed-by: Brian Paul Reviewed-by: Kenneth Graunke --- src/mesa/swrast/s_blit.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/src/mesa/swrast/s_blit.c b/src/mesa/swrast/s_blit.c index f77981f..ecec734 100644 --- a/src/mesa/swrast/s_blit.c +++ b/src/mesa/swrast/s_blit.c @@ -710,16 +710,17 @@ blit_linear(struct gl_context *ctx, } } - free(srcBuffer0); - free(srcBuffer1); - free(dstBuffer); - ctx->Driver.UnmapRenderbuffer(ctx, readRb); if (drawRb != readRb) { ctx->Driver.UnmapRenderbuffer(ctx, drawRb); } } + free(srcBuffer0); + free(srcBuffer1); + free(dstBuffer); + return; + fail_no_memory: free(srcBuffer0); free(srcBuffer1); -- 2.7.4