From mboxrd@z Thu Jan  1 00:00:00 1970
From: Maarten Lankhorst <maarten.lankhorst@canonical.com>
Subject: [PATCH] intel uxa: Fix use-after-free
Date: Tue, 19 Jun 2012 17:53:44 +0200
Message-ID: <4FE0A088.4090807@canonical.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Return-path: <dri-devel-bounces+sf-dri-devel=m.gmane.org@lists.freedesktop.org>
List-Unsubscribe: <http://lists.freedesktop.org/mailman/options/dri-devel>,
	<mailto:dri-devel-request@lists.freedesktop.org?subject=unsubscribe>
List-Archive: <http://lists.freedesktop.org/archives/dri-devel>
List-Post: <mailto:dri-devel@lists.freedesktop.org>
List-Help: <mailto:dri-devel-request@lists.freedesktop.org?subject=help>
List-Subscribe: <http://lists.freedesktop.org/mailman/listinfo/dri-devel>,
	<mailto:dri-devel-request@lists.freedesktop.org?subject=subscribe>
Sender: dri-devel-bounces+sf-dri-devel=m.gmane.org@lists.freedesktop.org
Errors-To: dri-devel-bounces+sf-dri-devel=m.gmane.org@lists.freedesktop.org
To: intel-gfx@lists.freedesktop.org
Cc: dri-devel@lists.freedesktop.org
List-Id: intel-gfx@lists.freedesktop.org

white is set to src if used, but src can be used in the maskFormat too.
Fixes crash when logging in on a sandybridge laptop.

Signed-off-by: Maarten Lankhorst <maarten.lankhorst@canonical.com>

---

diff --git a/uxa/uxa-glyphs.c b/uxa/uxa-glyphs.c
index e83464e..4b81756 100644
--- a/uxa/uxa-glyphs.c
+++ b/uxa/uxa-glyphs.c
@@ -538,9 +538,6 @@ uxa_check_glyphs(CARD8 op,
 		list++;
 	}
 
-	if (white)
-		FreePicture(white, 0);
-
 	if (maskFormat) {
 		x = extents.x1;
 		y = extents.y1;
@@ -554,6 +551,9 @@ uxa_check_glyphs(CARD8 op,
 		FreeScratchPixmapHeader(scratch);
 		pixman_image_unref(image);
 	}
+
+	if (white)
+		FreePicture(white, 0);
 }
 
 static inline unsigned int