cedric pushed a commit to branch efl-1.13.
http://git.enlightenment.org/core/efl.git/commit/?id=3ab85b3106fbbcdb46aaf90b4e6169cab9467922
commit 3ab85b3106fbbcdb46aaf90b4e6169cab9467922
Author: Cedric BAIL <ced...@osg.samsung.com>
Date: Tue Mar 24 23:09:28 2015 +0100
evas: fix use after free.
Thanks to Thanatermesis for tracking this in T2135.
---
src/modules/evas/engines/gl_common/evas_gl_image.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/src/modules/evas/engines/gl_common/evas_gl_image.c
b/src/modules/evas/engines/gl_common/evas_gl_image.c
index 0bd990a..3c279ac 100644
--- a/src/modules/evas/engines/gl_common/evas_gl_image.c
+++ b/src/modules/evas/engines/gl_common/evas_gl_image.c
@@ -763,9 +763,11 @@ evas_gl_common_image_update(Evas_Engine_GL_Context *gc,
Evas_GL_Image *im)
{
Image_Entry *ie;
if (!im->im) return;
- ie = &im->im->cache_entry;
evas_gl_common_image_alloc_ensure(im);
+ // alloc ensure can change im->im, so only get the local variable later.
+ ie = &im->im->cache_entry;
+
/*
if ((im->cs.space == EVAS_COLORSPACE_YCBCR422P601_PL) ||
(im->cs.space == EVAS_COLORSPACE_YCBCR422P709_PL))
--
