blender
/
blender
136
406
Fork 588
Code Issues 6.2k Pull Requests 755 Projects 19 Wiki Activity

Fix T103198: Missing bounds check for material_index attr in texpaint 

Texpaint now bounds checks material indices when looking up
materials, in case the user has corrupted the material_index
attribute somehow.  We may wish to report this to the user
somehow on entering texture paint mode.
This commit is contained in:
Joseph Eagar 2022-12-18 07:08:57 -08:00
parent 5a761a47e1
commit 0beb358a69
Notes: blender-bot 2023-05-22 12:16:50 +02:00 
Referenced by issue #88449: Blender LTS: Maintenance Task 2.93
Referenced by issue #88449, Blender LTS: Maintenance Task 2.93
Referenced by issue #100749, Blender LTS: Maintenance Task 3.3
Referenced by issue #103544, Texture Painting after boolean crash blender
Referenced by issue #103198, Crash on texture painting with invalid material indices attribute
Referenced by issue #102967, 3.4: Potential candidates for corrective releases
Referenced by issue #105219, Crashes when texture painting
Referenced by issue #108126, Texture paint crash (fixed already, backport request).
1 changed files with 14 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
source/blender/editors/sculpt_paint/paint_image_proj.cc
View File

@ -545,10 +545,20 @@ static int project_paint_face_paint_tile(Image *ima, const float *uv)
return 1001 + 10 * ty + tx;
}
static Material *tex_get_material(const ProjPaintState *ps, int poly_i)
{
int mat_nr = ps->material_indices == nullptr ? 0 : ps->material_indices[poly_i];
if (mat_nr >= 0 && mat_nr <= ps->ob->totcol) {
return ps->mat_array[mat_nr];
}
return nullptr;
}
static TexPaintSlot *project_paint_face_paint_slot(const ProjPaintState *ps, int tri_index)
{
const int poly_i = ps->mlooptri_eval[tri_index].poly;
Material *ma = ps->mat_array[ps->material_indices == nullptr ? 0 : ps->material_indices[poly_i]];
Material *ma = tex_get_material(ps, poly_i);
return ma ? ma->texpaintslot + ma->paint_active_slot : nullptr;
}
@ -559,7 +569,7 @@ static Image *project_paint_face_paint_image(const ProjPaintState *ps, int tri_i
}
const int poly_i = ps->mlooptri_eval[tri_index].poly;
Material *ma = ps->mat_array[ps->material_indices == nullptr ? 0 : ps->material_indices[poly_i]];
Material *ma = tex_get_material(ps, poly_i);
TexPaintSlot *slot = ma ? ma->texpaintslot + ma->paint_active_slot : nullptr;
return slot ? slot->ima : ps->canvas_ima;
}
@ -567,14 +577,14 @@ static Image *project_paint_face_paint_image(const ProjPaintState *ps, int tri_i
static TexPaintSlot *project_paint_face_clone_slot(const ProjPaintState *ps, int tri_index)
{
const int poly_i = ps->mlooptri_eval[tri_index].poly;
Material *ma = ps->mat_array[ps->material_indices == nullptr ? 0 : ps->material_indices[poly_i]];
Material *ma = tex_get_material(ps, poly_i);
return ma ? ma->texpaintslot + ma->paint_clone_slot : nullptr;
}
static Image *project_paint_face_clone_image(const ProjPaintState *ps, int tri_index)
{
const int poly_i = ps->mlooptri_eval[tri_index].poly;
Material *ma = ps->mat_array[ps->material_indices == nullptr ? 0 : ps->material_indices[poly_i]];
Material *ma = tex_get_material(ps, poly_i);
TexPaintSlot *slot = ma ? ma->texpaintslot + ma->paint_clone_slot : nullptr;
return slot ? slot->ima : ps->clone_ima;
}