blender
/
blender
136
406
Fork 590
Code Issues 6.2k Pull Requests 764 Projects 19 Wiki Activity

Fix: Use after free when removing attribute 

We currently check multiple dynamic attribute providers for the
attribute ID, even after it has been removed (which can free the name).
This was used as a simple way to remove multiple attributes with the
same name (dealing with name collisions). However, that doesn't happen
in practice at this point, since so much code has moved to the
attribute API which checks for it.
This commit is contained in:
Hans Goudey 2022-11-22 13:46:50 -06:00
parent 461cb550cc
commit 3f294a37f5
1 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
source/blender/blenkernel/intern/attribute_access_intern.hh
View File

@ -469,11 +469,12 @@ inline bool remove(void *owner, const AttributeIDRef &attribute_id)
return provider->try_delete(owner);
}
}
bool success = false;
for (const DynamicAttributesProvider *provider : providers.dynamic_attribute_providers()) {
success = provider->try_delete(owner, attribute_id) || success;
if (provider->try_delete(owner, attribute_id)) {
return true;
}
}
return success;
return false;
}
template<const ComponentAttributeProviders &providers>