cedric pushed a commit to branch efl-1.8.
http://git.enlightenment.org/core/efl.git/commit/?id=f7a971db13793f4049d875a24cade7433bb99ec6
commit f7a971db13793f4049d875a24cade7433bb99ec6
Author: Cedric BAIL <ced...@osg.samsung.com>
Date: Tue Mar 24 23:09:28 2015 +0100
evas: fix use after free.
Thanks to Thanatermesis for tracking this in T2135.
---
src/modules/evas/engines/gl_common/evas_gl_image.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/src/modules/evas/engines/gl_common/evas_gl_image.c
b/src/modules/evas/engines/gl_common/evas_gl_image.c
index 169b486..7b30f52 100644
--- a/src/modules/evas/engines/gl_common/evas_gl_image.c
+++ b/src/modules/evas/engines/gl_common/evas_gl_image.c
@@ -660,8 +660,11 @@ evas_gl_common_image_update(Evas_Engine_GL_Context *gc,
Evas_GL_Image *im)
{
Image_Entry *ie;
if (!im->im) return;
- ie = (Image_Entry *)(im->im);
evas_gl_common_image_alloc_ensure(im);
+
+ // alloc ensure can change im->im, so only get the local variable later.
+ ie = (Image_Entry *)(im->im);
+
/*
if ((im->cs.space == EVAS_COLORSPACE_YCBCR422P601_PL) ||
(im->cs.space == EVAS_COLORSPACE_YCBCR422P709_PL))
--
