UI: Fix use after free for instanced panel expansion

The "set_expand_from_list_data" function has to be called after updating
the panels' custom data pointers. Otherwise the wrong information is
retrieved in the best base and it will cause a crash in the worst case.
This commit is contained in:
Hans Goudey 2020-09-03 14:33:44 -05:00
parent 88b6dd1392
commit 953a031f15
1 changed files with 28 additions and 28 deletions

View File

@ -1890,13 +1890,6 @@ void uiTemplateModifiers(uiLayout *UNUSED(layout), bContext *C)
}
}
else {
/* The expansion might have been changed elsewhere, so we still need to set it. */
LISTBASE_FOREACH (Panel *, panel, &region->panels) {
if ((panel->type != NULL) && (panel->type->flag & PNL_INSTANCED)) {
UI_panel_set_expand_from_list_data(C, panel);
}
}
/* Assuming there's only one group of instanced panels, update the custom data pointers. */
Panel *panel = region->panels.first;
LISTBASE_FOREACH (ModifierData *, md, modifiers) {
@ -1917,6 +1910,13 @@ void uiTemplateModifiers(uiLayout *UNUSED(layout), bContext *C)
panel = panel->next;
}
/* The expansion might have been changed elsewhere, so we still need to set it. */
LISTBASE_FOREACH (Panel *, panel_iter, &region->panels) {
if ((panel_iter->type != NULL) && (panel_iter->type->flag & PNL_INSTANCED)) {
UI_panel_set_expand_from_list_data(C, panel_iter);
}
}
}
}
@ -2068,13 +2068,6 @@ void uiTemplateConstraints(uiLayout *UNUSED(layout), bContext *C, bool use_bone_
}
}
else {
/* The expansion might have been changed elsewhere, so we still need to set it. */
LISTBASE_FOREACH (Panel *, panel, &region->panels) {
if ((panel->type != NULL) && (panel->type->flag & PNL_INSTANCED)) {
UI_panel_set_expand_from_list_data(C, panel);
}
}
/* Assuming there's only one group of instanced panels, update the custom data pointers. */
Panel *panel = region->panels.first;
LISTBASE_FOREACH (bConstraint *, con, constraints) {
@ -2090,6 +2083,13 @@ void uiTemplateConstraints(uiLayout *UNUSED(layout), bContext *C, bool use_bone_
panel = panel->next;
}
/* The expansion might have been changed elsewhere, so we still need to set it. */
LISTBASE_FOREACH (Panel *, panel_iter, &region->panels) {
if ((panel_iter->type != NULL) && (panel_iter->type->flag & PNL_INSTANCED)) {
UI_panel_set_expand_from_list_data(C, panel_iter);
}
}
}
}
@ -2144,13 +2144,6 @@ void uiTemplateGpencilModifiers(uiLayout *UNUSED(layout), bContext *C)
}
}
else {
/* The expansion might have been changed elsewhere, so we still need to set it. */
LISTBASE_FOREACH (Panel *, panel, &region->panels) {
if ((panel->type != NULL) && (panel->type->flag & PNL_INSTANCED)) {
UI_panel_set_expand_from_list_data(C, panel);
}
}
/* Assuming there's only one group of instanced panels, update the custom data pointers. */
Panel *panel = region->panels.first;
LISTBASE_FOREACH (ModifierData *, md, modifiers) {
@ -2171,6 +2164,13 @@ void uiTemplateGpencilModifiers(uiLayout *UNUSED(layout), bContext *C)
panel = panel->next;
}
/* The expansion might have been changed elsewhere, so we still need to set it. */
LISTBASE_FOREACH (Panel *, panel_iter, &region->panels) {
if ((panel_iter->type != NULL) && (panel_iter->type->flag & PNL_INSTANCED)) {
UI_panel_set_expand_from_list_data(C, panel_iter);
}
}
}
}
@ -2226,13 +2226,6 @@ void uiTemplateShaderFx(uiLayout *UNUSED(layout), bContext *C)
}
}
else {
/* The expansion might have been changed elsewhere, so we still need to set it. */
LISTBASE_FOREACH (Panel *, panel, &region->panels) {
if ((panel->type != NULL) && (panel->type->flag & PNL_INSTANCED)) {
UI_panel_set_expand_from_list_data(C, panel);
}
}
/* Assuming there's only one group of instanced panels, update the custom data pointers. */
Panel *panel = region->panels.first;
LISTBASE_FOREACH (ShaderFxData *, fx, shaderfx) {
@ -2253,6 +2246,13 @@ void uiTemplateShaderFx(uiLayout *UNUSED(layout), bContext *C)
panel = panel->next;
}
/* The expansion might have been changed elsewhere, so we still need to set it. */
LISTBASE_FOREACH (Panel *, panel_iter, &region->panels) {
if ((panel_iter->type != NULL) && (panel_iter->type->flag & PNL_INSTANCED)) {
UI_panel_set_expand_from_list_data(C, panel_iter);
}
}
}
}