blender
/
blender
136
404
Fork 586
Code Issues 6.2k Pull Requests 762 Projects 19 Wiki Activity

Fix potential invalid memory access in surface force field BVH tree. 

Free the BVH tree immediately along with the mesh, otherwise we might access
invalid mesh data.

Differential Revision: https://developer.blender.org/D4201
This commit is contained in:
Andrew Williams 2019-01-22 12:51:14 +01:00 committed by Brecht Van Lommel
parent 414ebc68c2
commit 102631486b
3 changed files with 15 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
source/blender/blenkernel/intern/bvhutils.c
View File

@ -1112,6 +1112,8 @@ BVHTree *BKE_bvhtree_from_mesh_get(
data_cp.vert = mesh->mvert;
if (data_cp.cached == false) {
/* TODO: a global mutex lock held during the expensive operation of
* building the BVH tree is really bad for performance. */
BLI_rw_mutex_lock(&cache_rwlock, THREAD_LOCK_WRITE);
data_cp.cached = bvhcache_find(
mesh->runtime.bvh_cache, type, &data_cp.tree);

16
source/blender/blenlib/intern/BLI_kdopbvh.c
View File

@ -908,23 +908,17 @@ BVHTree *BLI_bvhtree_new(int maxsize, float epsilon, char tree_type, char axis)
fail:
MEM_SAFE_FREE(tree->nodes);
MEM_SAFE_FREE(tree->nodebv);
MEM_SAFE_FREE(tree->nodechild);
MEM_SAFE_FREE(tree->nodearray);
MEM_freeN(tree);
BLI_bvhtree_free(tree);
return NULL;
}
void BLI_bvhtree_free(BVHTree *tree)
{
if (tree) {
MEM_freeN(tree->nodes);
MEM_freeN(tree->nodearray);
MEM_freeN(tree->nodebv);
MEM_freeN(tree->nodechild);
MEM_SAFE_FREE(tree->nodes);
MEM_SAFE_FREE(tree->nodearray);
MEM_SAFE_FREE(tree->nodebv);
MEM_SAFE_FREE(tree->nodechild);
MEM_freeN(tree);
}
}

12
source/blender/modifiers/intern/MOD_surface.c
View File

@ -96,8 +96,15 @@ static void deformVerts(
SurfaceModifierData *surmd = (SurfaceModifierData *) md;
const int cfra = (int)DEG_get_ctime(ctx->depsgraph);
/* Free mesh and BVH cache. */
if (surmd->bvhtree) {
free_bvhtree_from_mesh(surmd->bvhtree);
MEM_SAFE_FREE(surmd->bvhtree);
}
if (surmd->mesh) {
BKE_id_free(NULL, surmd->mesh);
surmd->mesh = NULL;
}
if (mesh) {
@ -168,10 +175,7 @@ static void deformVerts(
surmd->cfra = cfra;
if (surmd->bvhtree)
free_bvhtree_from_mesh(surmd->bvhtree);
else
surmd->bvhtree = MEM_callocN(sizeof(BVHTreeFromMesh), "BVHTreeFromMesh");
surmd->bvhtree = MEM_callocN(sizeof(BVHTreeFromMesh), "BVHTreeFromMesh");
if (surmd->mesh->totpoly)
BKE_bvhtree_from_mesh_get(surmd->bvhtree, surmd->mesh, BVHTREE_FROM_LOOPTRI, 2);