Skip to content

gallium/u_threaded: fix glMultiDrawElementsEXT() use-after-free and data corruption bugs

Max Kellermann requested to merge MaxKellermann/mesa:draw_multi_slots into main

Fix for two bugs: a use-after-free bug due to wrong reference counting, and an index buffer data corruption bug, both triggerable with glMultiDrawElementsEXT() when more than one TC_CALL_draw_multi slot is allocated for one glMultiDrawElementsEXT() call.

Backport to stable recommended. I think this bug has been lurking in Mesa for a very long time.

Merge request reports