[PATCH 1/2] xaa: Free the scratch pixmap header before freeing the contents

[Chris Wilson]

Some DDX may be sensitive to the ordering and could conceivably continue
to use the memory freed before FreeScratchPixmapHeader is called.

Signed-off-by: Chris Wilson <chris at chris-wilson.co.uk>
---
 hw/xfree86/xaa/xaaOffscreen.c |    5 ++---
 1 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/hw/xfree86/xaa/xaaOffscreen.c b/hw/xfree86/xaa/xaaOffscreen.c
index cd0d9a9..8fa5d6d 100644
--- a/hw/xfree86/xaa/xaaOffscreen.c
+++ b/hw/xfree86/xaa/xaaOffscreen.c
@@ -90,12 +90,11 @@ XAAMoveInOffscreenPixmaps(ScreenPtr pScreen)
 	(*pGC->ops->CopyArea)((DrawablePtr)tmpPix, (DrawablePtr)pPix, pGC, 
 		0, 0, pPix->drawable.width, pPix->drawable.height, 0, 0);	
 
-	free(data);
-	tmpPix->devPrivate.ptr = NULL;
-
 	FreeScratchGC(pGC);
 	FreeScratchPixmapHeader(tmpPix);
 
+	free(data);
+
 	pPriv->offscreenArea = area;
 	pLink->area = NULL;
 	pLink = pLink->next;
-- 
1.7.4.1