shader: avoid use after free

If the shader failed to be finished, it should be removed from the
hashtable if it was already inserted. Use the goto error path in this
case to handle shader destroy and prevent potential later lookup of
invalid shader from the hashtable.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>

src/vrend_renderer.c

@@ -2145,7 +2145,6 @@ static int vrend_finish_shader(struct vrend_context *ctx,
 
    r = vrend_shader_select(ctx, sel, NULL);
    if (r) {
-      vrend_destroy_shader_selector(sel);
       return EINVAL;
    }
    return 0;
@@ -2245,9 +2244,11 @@ int vrend_create_shader(struct vrend_context *ctx,
          goto error;
       }
 
-      if (vrend_finish_shader(ctx, sel, tokens))
-         new_shader = false;
-      else {
+      if (vrend_finish_shader(ctx, sel, tokens)) {
+         free(tokens);
+         ret = EINVAL;
+         goto error;
+      } else {
          free(sel->tmp_buf);
          sel->tmp_buf = NULL;
       }