| Name |
Last commit
|
Last update |
|---|---|---|
| .. | ||
| common | ||
| compiler | ||
| libANGLE | ||
| libEGL | ||
| libGLESv2 | ||
| tests | ||
| third_party | ||
| angle.gyp | ||
| commit.h | ||
| commit_id.py | ||
| compiler.gypi | ||
| copy_compiler_dll.bat | ||
| libEGL.gypi | ||
| libGLESv2.gypi |
Otherwise when detaching vertex array 0 and N the following would happen:
- call Context::deleteVertexArray(0)
- call Context::detachVertexArray(0)
- call State::removeVertexArrayBinding(0)
set mVertexArray to nullptr, returns true
- call State::bindVertexArray(0)
reset mVertexArray to its previous value
- call Context::deleteVertexArray(n)
- call Context::detachVertexArray(n)
- call State::removeVertexArrayBinding(n)
Incorrectly call mVertexArray->id() which is a use after free.
BUG=angleproject:1137
Change-Id: I594044fee6c90b1775a61943b15df92bf323ff2a
Reviewed-on: https://chromium-review.googlesource.com/295123Reviewed-by:
Jamie Madill <jmadill@chromium.org>
Reviewed-by:
Geoff Lang <geofflang@chromium.org>
Tested-by:
Corentin Wallez <cwallez@chromium.org>
| Name |
Last commit
|
Last update |
|---|---|---|
| .. | ||
| common | Loading commit data... | |
| compiler | Loading commit data... | |
| libANGLE | Loading commit data... | |
| libEGL | Loading commit data... | |
| libGLESv2 | Loading commit data... | |
| tests | Loading commit data... | |
| third_party | Loading commit data... | |
| angle.gyp | Loading commit data... | |
| commit.h | Loading commit data... | |
| commit_id.py | Loading commit data... | |
| compiler.gypi | Loading commit data... | |
| copy_compiler_dll.bat | Loading commit data... | |
| libEGL.gypi | Loading commit data... | |
| libGLESv2.gypi | Loading commit data... |