From 1a465fef9bc21142eecca3999f0761a3c0501a09 Mon Sep 17 00:00:00 2001 From: Dave Airlie Date: Fri, 3 Aug 2012 16:41:45 +1000 Subject: [PATCH] pixmap: have slave pixmap take a reference on master pixmap Since the free routines free the master pixmap then the slave, we should be taking a reference when we bind them together. Fixes a use-after-free when resizing a primed gears. Signed-off-by: Dave Airlie Reviewed-by: Alex Deucher --- dix/pixmap.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/dix/pixmap.c b/dix/pixmap.c index 9163e99eb..241881262 100644 --- a/dix/pixmap.c +++ b/dix/pixmap.c @@ -148,6 +148,10 @@ PixmapPtr PixmapShareToSlave(PixmapPtr pixmap, ScreenPtr slave) pixmap->drawable.height, depth, 0, pixmap->devKind, NULL); + /* have the slave pixmap take a reference on the master pixmap + later we destroy them both at the same time */ + pixmap->refcnt++; + spix->master_pixmap = pixmap; ret = slave->SetSharedPixmapBacking(spix, handle);