Bug#383209: libgl1-mesa-dri: tdfx dri: wrong interface to alloc tex memory.

[Kurt Roeckx]

Package: libgl1-mesa-dri
Version: 6.4.2-1
Severity: important
Tags: patch

Hi,

It seems that the tdfx dri driver is is using the wrong interface to
allocate tex memory.  At the moment it gets freed, it then has a problem
since it's free thru an other interface.  This results in segfaults.

The tex memory has allignment requirements, and stores an original
pointer just before the alligned memory, and then calls free with that
pointer.  If it's not allocated thru the functions that do the
allignment, you have a problem when freeing.

A patch for the problem is attached.


Kurt

-------------- next part --------------
--- mesa-6.4.2.orig/src/mesa/drivers/dri/tdfx/tdfx_tex.c
+++ mesa-6.4.2/src/mesa/drivers/dri/tdfx/tdfx_tex.c
@@ -1356,10 +1356,10 @@
                                                         	1,
                                                         	internalFormat);
        dstRowStride = _mesa_compressed_row_stride(internalFormat, mml->width);
-       texImage->Data = _mesa_malloc(texImage->CompressedSize);
+       texImage->Data = _mesa_alloc_texmemory(texImage->CompressedSize);
     } else {
        dstRowStride = mml->width * texelBytes;
-       texImage->Data = _mesa_malloc(mml->width * mml->height * texelBytes);
+       texImage->Data = _mesa_alloc_texmemory(mml->width * mml->height * texelBytes);
     }
     if (!texImage->Data) {
        _mesa_error(ctx, GL_OUT_OF_MEMORY, "glTexImage2D");
@@ -1662,7 +1662,7 @@
                                                                 mml->height,
                                                                 1,
                                                                 internalFormat);
-       texImage->Data = _mesa_malloc(texImage->CompressedSize);
+       texImage->Data = _mesa_alloc_texmemory(texImage->CompressedSize);
        if (!texImage->Data) {
           _mesa_error(ctx, GL_OUT_OF_MEMORY, "glCompressedTexImage2D");
           return;