From d42ec53154b79257ec727ad012b9bcbee900ddaf Mon Sep 17 00:00:00 2001
From: "Carsten Haitzler (Rasterman)" <raster@rasterman.com>
Date: Sat, 2 Sep 2017 21:47:18 +0900
Subject: [PATCH] wayland_shm - clean out ptrs after free - seeing invalid
 mem/ptr access

enlightenment internal windows insta segv e on rpi. after much hunting
it seems a fallback is happening and bunk ptrs are being used. this at
least will make the problems more reliable with null ptrs.
---
 src/modules/evas/engines/wayland_shm/evas_dmabuf.c | 6 +++++-
 src/modules/evas/engines/wayland_shm/evas_shm.c    | 1 +
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/src/modules/evas/engines/wayland_shm/evas_dmabuf.c b/src/modules/evas/engines/wayland_shm/evas_dmabuf.c
index 5c9619e..5babde2 100644
--- a/src/modules/evas/engines/wayland_shm/evas_dmabuf.c
+++ b/src/modules/evas/engines/wayland_shm/evas_dmabuf.c
@@ -479,6 +479,7 @@ _allocation_complete(Dmabuf_Buffer *b)
     * buffer type...
     */
    _fallback(b->surface, b->w, b->h);
+   b->surface = NULL;
 }
 
 static void
@@ -591,12 +592,13 @@ _evas_dmabuf_surface_reconfigure(Surface *s, int w, int h, uint32_t flags EINA_U
              _evas_dmabuf_buffer_destroy(b);
           }
         buf = _evas_dmabuf_buffer_init(surface, w, h);
-        surface->buffer[i] = buf;
         if (!buf)
            {
               _fallback(surface, w, h);
+              s->surf.dmabuf = NULL;
               return;
            }
+        surface->buffer[i] = buf;
      }
 }
 
@@ -758,6 +760,8 @@ _internal_evas_dmabuf_surface_destroy(Dmabuf_Surface *surface)
       _evas_dmabuf_buffer_destroy(surface->buffer[i]);
 
    free(surface->buffer);
+   surface->buffer = NULL;
+   surface->nbuf = 0;
    free(surface);
 }
 
diff --git a/src/modules/evas/engines/wayland_shm/evas_shm.c b/src/modules/evas/engines/wayland_shm/evas_shm.c
index 031b90f..8a622f6 100644
--- a/src/modules/evas/engines/wayland_shm/evas_shm.c
+++ b/src/modules/evas/engines/wayland_shm/evas_shm.c
@@ -394,6 +394,7 @@ _evas_shm_surface_destroy(Surface *surface)
      _shm_leaf_destroy(&surface->surf.shm->leaf[i]);
 
    free(surface->surf.shm);
+   surface->surf.shm = NULL;
 }
 
 void 
-- 
2.7.4