fix the potential memory corruption 67/163667/1
authorBoram Park <boram1288.park@samsung.com>
Tue, 12 Dec 2017 23:12:19 +0000 (08:12 +0900)
committerBoram Park <boram1288.park@samsung.com>
Tue, 12 Dec 2017 23:14:33 +0000 (08:14 +0900)
Change-Id: I24837d1d9ddc53268c5ebebde1c499afb1e05303

src/tbm_bufmgr_dumb.c

index 01705b1..bca0d4a 100644 (file)
@@ -485,7 +485,7 @@ tbm_dumb_bo_alloc(tbm_bo bo, int size, int flags)
 static void
 tbm_dumb_bo_free(tbm_bo bo)
 {
-       tbm_bo_dumb bo_dumb;
+       tbm_bo_dumb bo_dumb, temp;
        tbm_bufmgr_dumb bufmgr_dumb;
 
        if (!bo)
@@ -519,12 +519,15 @@ tbm_dumb_bo_free(tbm_bo bo)
        /* delete bo from hash */
        int ret;
 
-       ret = drmHashLookup(bufmgr_dumb->hashBos, bo_dumb->name, (void**)&bo_dumb);
+       ret = drmHashLookup(bufmgr_dumb->hashBos, bo_dumb->name, (void**)&temp);
        if (ret == 0)
                drmHashDelete(bufmgr_dumb->hashBos, bo_dumb->name);
        else
                TBM_DUMB_LOG("warning Cannot find bo to Hash(%d), ret =%d\n", bo_dumb->name, ret);
 
+       if (temp != bo_dumb)
+               TBM_DUMB_LOG("hashBos probably has several BOs with same name!!!\n");
+
        /* Free gem handle */
        struct drm_gem_close arg = {0, };
        memset(&arg, 0, sizeof(arg));