blender
/
blender
126
393
Fork 565
Code Issues 6.2k Pull Requests 748 Projects 19 Wiki Activity

Fix (unreported) use-after-free case in Properties Editor ID remapping code. 

Regression in rBa21bca0e20a051, found while investigating T97069.
This commit is contained in:
Bastien Montagne 2022-04-12 18:11:08 +02:00
parent 77db370cb6
commit 48014fbf14
1 changed files with 7 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
source/blender/editors/space_buttons/space_buttons.c
View File

@ -861,12 +861,11 @@ static void buttons_id_remap(ScrArea *UNUSED(area),
for (int i = 0; i < path->len; i++) {
switch (BKE_id_remapper_apply(mappings, &path->ptr[i].owner_id, ID_REMAP_APPLY_DEFAULT)) {
case ID_REMAP_RESULT_SOURCE_UNASSIGNED: {
if (i == 0) {
MEM_SAFE_FREE(sbuts->path);
}
else {
path->len = i;
if (i != 0) {
/* If the first item in the path is cleared, the whole path is cleared, so no need to
* clear further items here, see also at the end of this block. */
memset(&path->ptr[i], 0, sizeof(path->ptr[i]) * (path->len - i));
path->len = i;
}
break;
}
@ -887,6 +886,9 @@ static void buttons_id_remap(ScrArea *UNUSED(area),
}
}
}
if (path->len == 0) {
MEM_SAFE_FREE(sbuts->path);
}
}
if (sbuts->texuser) {