Fix T89247: Dereference arguments to comparison function correctly
`bm_face_len_cmp` incorrectly interpreted its arguments as `BMFace *` instead of `BMFace **`, causing an out-of-bounds read. Ref D11637
This commit is contained in:
parent
32658bb5c9
commit
129798cacb
Notes:
blender-bot
2023-02-14 06:27:47 +01:00
Referenced by issue #88449, Blender LTS: Maintenance Task 2.93 Referenced by issue #89247, Select Similar Face Regions triggers AddressSanitizer crash
|
@ -553,7 +553,8 @@ static void bm_uuidwalk_pass_add(UUIDWalk *uuidwalk,
|
|||
|
||||
static int bm_face_len_cmp(const void *v1, const void *v2)
|
||||
{
|
||||
const BMFace *f1 = v1, *f2 = v2;
|
||||
const BMFace *f1 = *((BMFace **)v1);
|
||||
const BMFace *f2 = *((BMFace **)v2);
|
||||
|
||||
if (f1->len > f2->len) {
|
||||
return 1;
|
||||
|
|
Loading…
Reference in New Issue