Running select_linked_pick with a negative index crashes Blender with an access violation #89367

New Issue

Fen · 2021-06-22T17:35:35+02:00

Fen commented

2021-06-22 17:35:35 +02:00

System Information
Operating system: Windows-10-10.0.19041-SP0 64 Bits
Graphics card: GeForce GTX 1080/PCIe/SSE2 NVIDIA Corporation 4.5.0 NVIDIA 446.14

Blender Version
Broken: version: 2.93.0, branch: master, commit date: 2021-06-02 11:21, hash: 84da05a8b8
Worked: 2.80 accepts an index argument but doesn't crash

Broken by: 211d7ff3cf
Worked: 65965a892f

Short description of error
bpy.ops.mesh.select_linked_pick accepts object_index and index arguments. They are set to -1 by default (probably indicating that they're not meant to be used). If object_index corresponds to an object in the scene and index is a negative number, Blender crashes.

Exact steps for others to reproduce the error

Select the default cube and go into edit mode
Open a Python console
Run bpy.ops.mesh.select_linked_pick(object_index=0)
Crash

Alternatively, you can provide any negative index value; it should always crash (although it might run into valid memory if you're lucky)

A debug build reports an access violation:

SUMMARY: AddressSanitizer: access-violation D:\blender-git\blender\source\blender\editors\mesh\editmesh_select.c:3451 in edbm_select_linked_pick_ex

Debug stack trace: P2202

**System Information** Operating system: Windows-10-10.0.19041-SP0 64 Bits Graphics card: GeForce GTX 1080/PCIe/SSE2 NVIDIA Corporation 4.5.0 NVIDIA 446.14 **Blender Version** Broken: version: 2.93.0, branch: master, commit date: 2021-06-02 11:21, hash: `84da05a8b8` Worked: 2.80 accepts an `index` argument but doesn't crash Broken by: 211d7ff3cf Worked: 65965a892f **Short description of error** `bpy.ops.mesh.select_linked_pick` accepts `object_index` and `index` arguments. They are set to `-1` by default (probably indicating that they're not meant to be used). If `object_index` corresponds to an object in the scene and `index` is a negative number, Blender crashes. **Exact steps for others to reproduce the error** 1. Select the default cube and go into edit mode 2. Open a Python console 3. Run `bpy.ops.mesh.select_linked_pick(object_index=0)` 4. Crash Alternatively, you can provide any negative index value; it should always crash (although it might run into valid memory if you're lucky) A debug build reports an access violation: `SUMMARY: AddressSanitizer: access-violation D:\blender-git\blender\source\blender\editors\mesh\editmesh_select.c:3451 in edbm_select_linked_pick_ex` Debug stack trace: [P2202](https://archive.blender.org/developer/P2202.txt)

Fen commented

2021-06-22 17:35:35 +02:00

Added subscriber: @chemicalcrux

Fen self-assigned this 2021-06-22 17:59:45 +02:00

Fen commented

2021-06-22 17:59:45 +02:00

Looks like 211d7ff3cf lost this sanity check:

if (index < 0 || index >= (bm->totvert + bm->totedge + bm->totface)) {
    return OPERATOR_CANCELLED;
  }

EDBM_elem_from_index_any_multi correctly handles invalid object indices (as negative indices become a very large uint), but EDBM_elem_from_index_any uses signed integers, so its index < bm->totvert test succeeds. Updating it to reject negative indices should resolve this problem, if it's deemed to be a bug worth fixing.

Looks like 211d7ff3cf lost this sanity check: ``` if (index < 0 || index >= (bm->totvert + bm->totedge + bm->totface)) { return OPERATOR_CANCELLED; } ``` `EDBM_elem_from_index_any_multi` correctly handles invalid object indices (as negative indices become a very large uint), but `EDBM_elem_from_index_any` uses signed integers, so its `index < bm->totvert` test succeeds. Updating it to reject negative indices should resolve this problem, if it's deemed to be a bug worth fixing.

Fen commented

2021-06-22 18:18:18 +02:00

Proposed a fix in D11672

Proposed a fix in [D11672](https://archive.blender.org/developer/D11672)

Jesse Yurkovich commented

2021-06-22 21:10:18 +02:00

Changed status from 'Needs Triage' to: 'Confirmed'