blender
/
blender
129
398
Fork 572
Code Issues 6.2k Pull Requests 747 Projects 19 Wiki Activity

Fix T47644: crash (use-after-free) regression from rB7a74738914a66e. 

Handling `me` data here is not good idea anyway, we override it completly with data
from `tmp` (crash came from freeing already existing bb from me, while pointer still existed in tmp).

(rediscovered it while working on T47676...).

To be backported to 2.77.
This commit is contained in:
Bastien Montagne 2016-03-03 14:44:05 +01:00 committed by Sergey Sharybin
parent 67b16c6170
commit b00822e42d
1 changed files with 3 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
source/blender/blenkernel/intern/DerivedMesh.c
View File

@ -808,13 +808,12 @@ void DM_to_mesh(DerivedMesh *dm, Mesh *me, Object *ob, CustomDataMask mask, bool
}
/* Clear selection history */
tmp.mselect = NULL;
MEM_SAFE_FREE(tmp.mselect);
tmp.totselect = 0;
if (me->mselect) {
MEM_freeN(me->mselect);
}
BLI_assert(ELEM(tmp.bb, NULL, me->bb));
if (me->bb) {
MEM_freeN(me->bb);
tmp.bb = NULL;
}
/* skip the listbase */