Fix T51900: Crash after pressing "F" multiple times.
`BMO_iter_as_array()` may fill less items than requested in given array, so we have to update number of items to work on from its returned value, otherwise code might try to use uninitialized memory.
This commit is contained in:
parent
f11bcbed9d
commit
2c0ee61f6d
Notes:
blender-bot
2023-02-14 07:47:59 +01:00
Referenced by issue #51900, Crash after pressing "F" multiple times.
|
@ -74,13 +74,13 @@ void bmo_contextual_create_exec(BMesh *bm, BMOperator *op)
|
|||
BMVert *verts[2];
|
||||
BMEdge *e;
|
||||
|
||||
BMO_iter_as_array(op->slots_in, "geom", BM_VERT, (void **)verts, 2);
|
||||
|
||||
/* create edge */
|
||||
e = BM_edge_create(bm, verts[0], verts[1], NULL, BM_CREATE_NO_DOUBLE);
|
||||
BMO_edge_flag_enable(bm, e, ELE_OUT);
|
||||
tote += 1;
|
||||
BMO_slot_buffer_from_enabled_flag(bm, op, op->slots_out, "edges.out", BM_EDGE, ELE_OUT);
|
||||
if (BMO_iter_as_array(op->slots_in, "geom", BM_VERT, (void **)verts, 2) == 0) {
|
||||
/* create edge */
|
||||
e = BM_edge_create(bm, verts[0], verts[1], NULL, BM_CREATE_NO_DOUBLE);
|
||||
BMO_edge_flag_enable(bm, e, ELE_OUT);
|
||||
tote += 1;
|
||||
BMO_slot_buffer_from_enabled_flag(bm, op, op->slots_out, "edges.out", BM_EDGE, ELE_OUT);
|
||||
}
|
||||
return;
|
||||
}
|
||||
|
||||
|
@ -283,13 +283,13 @@ void bmo_contextual_create_exec(BMesh *bm, BMOperator *op)
|
|||
*/
|
||||
if (totv > 2) {
|
||||
/* TODO, some of these vertes may be connected by edges,
|
||||
* this connectivity could be used rather then treating
|
||||
* this connectivity could be used rather than treating
|
||||
* them as a bunch of isolated verts. */
|
||||
|
||||
BMVert **vert_arr = MEM_mallocN(sizeof(BMVert *) * totv, __func__);
|
||||
BMFace *f;
|
||||
|
||||
BMO_iter_as_array(op->slots_in, "geom", BM_VERT, (void **)vert_arr, totv);
|
||||
totv = BMO_iter_as_array(op->slots_in, "geom", BM_VERT, (void **)vert_arr, totv);
|
||||
|
||||
BM_verts_sort_radial_plane(vert_arr, totv);
|
||||
|
||||
|
|
Loading…
Reference in New Issue