blender
/
blender
136
404
Fork 586
Code Issues 6.2k Pull Requests 751 Projects 19 Wiki Activity

Fix T96691: Heap corruption in file_browse_exec 

Regression in [0], also use pad buffer by 1 instead of 2 which is no
longer needed as the trailing slash is no longer added
after allocating the string.

0682af0d63
This commit is contained in:
Campbell Barton 2022-03-29 10:11:40 +11:00
parent 27424b758a
commit 87d9d33c00
Notes: blender-bot 2023-02-13 16:05:03 +01:00 
Referenced by issue #96691, Heap corruption in file_browse_exec
Referenced by issue #96241, 3.1: Potential candidates for corrective releases
1 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
source/blender/editors/space_buttons/buttons_ops.c
View File

@ -207,13 +207,13 @@ static int file_browse_exec(bContext *C, wmOperator *op)
/* Do this first so '//' isn't converted to '//\' on windows. */
BLI_path_slash_ensure(path);
if (is_relative) {
const int path_len = BLI_strncpy_rlen(path, str, FILE_MAX);
BLI_path_rel(path, BKE_main_blendfile_path(bmain));
str = MEM_reallocN(str, path_len + 2);
BLI_strncpy(str, path, FILE_MAX);
str_len = strlen(path);
str = MEM_reallocN(str, str_len + 1);
memcpy(str, path, str_len + 1);
}
else {
str = MEM_reallocN(str, str_len + 2);
str = MEM_reallocN(str, str_len + 1);
}
}
else {