blender
/
blender
136
406
Fork 587
Code Issues 6.2k Pull Requests 755 Projects 19 Wiki Activity

Fix: Use after free when removing attribute on instances 

Assume that only one layer matches the id and return instead
of continuing to iterate over attributes after the layers have
been potentially reallocated.
This commit is contained in:
Hans Goudey 2022-04-14 13:04:16 -05:00
parent 80859a6cb2
commit 05715eaea1
1 changed files with 2 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
source/blender/blenkernel/intern/attribute_access.cc
View File

@ -746,15 +746,14 @@ bool CustomDataAttributes::create_by_move(const AttributeIDRef &attribute_id,
bool CustomDataAttributes::remove(const AttributeIDRef &attribute_id)
{
bool result = false;
for (const int i : IndexRange(data.totlayer)) {
const CustomDataLayer &layer = data.layers[i];
if (custom_data_layer_matches_attribute_id(layer, attribute_id)) {
CustomData_free_layer(&data, layer.type, size_, i);
result = true;
return true;
}
}
return result;
return false;
}
void CustomDataAttributes::reallocate(const int size)