blender
/
blender
128
395
Fork 567
Code Issues 6.2k Pull Requests 749 Projects 19 Wiki Activity

Fix T89247: Dereference arguments to comparison function correctly 

`bm_face_len_cmp` incorrectly interpreted its arguments as `BMFace *`
instead of `BMFace **`, causing an out-of-bounds read.

Ref D11637
This commit is contained in:
Fen 2021-06-18 11:13:09 +10:00 committed by Jeroen Bakker
parent f6fb695ed8
commit 8dd18a77e7
Notes: blender-bot 2023-09-08 04:55:43 +02:00 
Referenced by issue #89247, Select Similar Face Regions triggers AddressSanitizer crash
Referenced by issue #77348, Blender LTS: Maintenance Task 2.83
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
source/blender/bmesh/tools/bmesh_region_match.c
View File

@ -561,7 +561,8 @@ static void bm_uuidwalk_pass_add(UUIDWalk *uuidwalk,
static int bm_face_len_cmp(const void *v1, const void *v2)
{
const BMFace *f1 = v1, *f2 = v2;
const BMFace *f1 = *((BMFace **)v1);
const BMFace *f2 = *((BMFace **)v2);
if (f1->len > f2->len) {
return 1;