blender
/
blender
128
396
Fork 569
Code Issues 6.2k Pull Requests 756 Projects 19 Wiki Activity

Fix T94674: crash reading ORCOs from an Alembic animation 

The crash is caused as the data is only for the first frame, but the mesh
changes topology, so reading the data in subsequent frames causes a
buffer overflow. To fix this, we check that the data size matches the
mesh's vertex count.
This commit is contained in:
Kévin Dietrich 2022-01-06 11:47:40 +01:00
parent ed3fecae8e
commit 88e15ff1e6
Notes: blender-bot 2024-01-16 18:05:25 +01:00 
Referenced by issue #94674, Playback of Alembic file results in an EXCEPTION_ACCESS_VIOLATION crash within the tbbmalloc.dll module
1 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
source/blender/io/alembic/intern/abc_customdata.cc
View File

@ -545,6 +545,12 @@ void read_generated_coordinates(const ICompoundProperty &prop,
const size_t totvert = abc_ocro.get()->size();
Mesh *mesh = config.mesh;
if (totvert != mesh->totvert) {
/* Either the data is somehow corrupted, or we have a dynamic simulation where only the ORCOs
* for the first frame were exported. */
return;
}
void *cd_data;
if (CustomData_has_layer(&mesh->vdata, CD_ORCO)) {
cd_data = CustomData_get_layer(&mesh->vdata, CD_ORCO);