blender
/
blender
129
398
Fork 572
Code Issues 6.2k Pull Requests 748 Projects 19 Wiki Activity

Fix (unreported) buffer-overflow in new lattice code. 

Follow-up to rBc0beeeb5de0cbc, fixing overflow accesses on arrays
introduced by rB042143440d76.

It's never 'OK' to access invalid memory...
This commit is contained in:
Bastien Montagne 2020-10-30 15:31:01 +01:00
parent a1d8559a42
commit 8b836f6894
1 changed files with 10 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
source/blender/blenkernel/intern/lattice_deform.c
View File

@ -235,10 +235,16 @@ void BKE_lattice_deform_data_eval_co(LatticeDeformData *lattice_deform_data,
#ifdef __SSE2__
{
__m128 weight_vec = _mm_set1_ps(u);
/* This will load one extra element, this is ok because
* we ignore that part of register anyway.
*/
__m128 lattice_vec = _mm_loadu_ps(&latticedata[idx * 3]);
/* We need to address special case for last item to avoid accessing invalid memory. */
__m128 lattice_vec;
if (idx * 3 == idx_w_max) {
copy_v3_v3((float *)&lattice_vec, &latticedata[idx * 3]);
}
else {
/* When not on last item, we can safely access one extra float, it will be ignored
* anyway. */
lattice_vec = _mm_loadu_ps(&latticedata[idx * 3]);
}
co_vec = _mm_add_ps(co_vec, _mm_mul_ps(lattice_vec, weight_vec));
}
#else