blender
/
blender
136
406
Fork 588
Code Issues 6.2k Pull Requests 752 Projects 19 Wiki Activity

Fix T89265: Crash when tabbing through num inputs 

Fix by reverting the part of ec30cf0b74
that assigned `but->editval` in `ui_numedit_begin_set_values`.

Causing access freed memory when using tab to switch
to a numeric input and then leaving the textbox by clicking outside.
This was because `ui_numedit_begin_set_values` shouldn't need to set
`but->editval` and overwrite the pointer.
This would set a pointer that had previously been freed,
causing a `NULL` check to fail later on.

Ref D11679
This commit is contained in:
Falk David 2021-06-23 14:56:36 +10:00 committed by Jeroen Bakker
parent 27e3265267
commit 174f39bd03
Notes: blender-bot 2023-02-14 08:33:26 +01:00 
Referenced by issue #88449, Blender LTS: Maintenance Task 2.93
Referenced by issue #89265, Use-after-free when tabbing through numeric inputs
1 changed files with 11 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
source/blender/editors/interface/interface_handlers.c
View File

@ -3890,6 +3890,13 @@ static void ui_do_but_textedit_select(
/** \name Button Number Editing (various types)
* \{ */
static void ui_numedit_begin_set_values(uiBut *but, uiHandleButtonData *data)
{
data->startvalue = ui_but_value_get(but);
data->origvalue = data->startvalue;
data->value = data->origvalue;
}
static void ui_numedit_begin(uiBut *but, uiHandleButtonData *data)
{
if (but->type == UI_BTYPE_CURVE) {
@ -3915,16 +3922,12 @@ static void ui_numedit_begin(uiBut *but, uiHandleButtonData *data)
but->editvec = data->vec;
}
else {
float softrange, softmin, softmax;
data->startvalue = ui_but_value_get(but);
data->origvalue = data->startvalue;
data->value = data->origvalue;
ui_numedit_begin_set_values(but, data);
but->editval = &data->value;
softmin = but->softmin;
softmax = but->softmax;
softrange = softmax - softmin;
float softmin = but->softmin;
float softmax = but->softmax;
float softrange = softmax - softmin;
if ((but->type == UI_BTYPE_NUM) && (ui_but_is_cursor_warp(but) == false)) {
uiButNumber *number_but = (uiButNumber *)but;