diff options
| author | Chris Wilson <chris@chris-wilson.co.uk> | 2016-01-25 15:37:01 +0000 |
|---|---|---|
| committer | Chris Wilson <chris@chris-wilson.co.uk> | 2016-01-25 15:39:19 +0000 |
| commit | 21fa92a9ba254527a8661ddde837c7a4c5ff5493 (patch) | |
| tree | bc0762a716343ae376f0eb63e04d04a4e7fdda60 /src/sna/sna_damage.h | |
| parent | b48d4a7917ab793526be47559becc64aacd347ae (diff) | |
sna/damage: Prevent freeing a NULL damage marked as all-damage
After an allocation failure, we may mark a NULL damage pointer as being
all-damaged. This works on the whole as most places we only ask whether it
is all or not damaged, and if we do a partial fallback we should just
then migrate the whole pixmap. However, we tried to destroy the NULL
damage pointer, and crashed.
Reported-by: Franck Delache <franck.delache@grassvalley.com>
References: https://bugs.freedesktop.org/show_bug.cgi?id=93720
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Diffstat (limited to 'src/sna/sna_damage.h')
| -rw-r--r-- | src/sna/sna_damage.h | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/src/sna/sna_damage.h b/src/sna/sna_damage.h index 272e83bc..36652556 100644 --- a/src/sna/sna_damage.h +++ b/src/sna/sna_damage.h @@ -267,7 +267,7 @@ int _sna_damage_get_boxes(struct sna_damage *damage, const BoxRec **boxes); static inline int sna_damage_get_boxes(struct sna_damage *damage, const BoxRec **boxes) { - assert(damage); + assert(DAMAGE_PTR(damage)); if (DAMAGE_IS_ALL(damage)) { *boxes = &DAMAGE_PTR(damage)->extents; @@ -319,7 +319,7 @@ static inline void sna_damage_reduce_all(struct sna_damage **_damage, void __sna_damage_destroy(struct sna_damage *damage); static inline void sna_damage_destroy(struct sna_damage **damage) { - if (*damage == NULL) + if (DAMAGE_PTR(*damage) == NULL) return; __sna_damage_destroy(DAMAGE_PTR(*damage)); |