Fix T96691: Heap corruption in file_browse_exec
Regression in [0], also use pad buffer by 1 instead of 2 which is no
longer needed as the trailing slash is no longer added
after allocating the string.
0682af0d63
This commit is contained in:
parent
c33870ab14
commit
9f15ee3c7a
Notes:
blender-bot
2023-02-14 12:01:57 +01:00
Referenced by issue #96691, Heap corruption in file_browse_exec Referenced by issue #96241, 3.1: Potential candidates for corrective releases
|
@ -222,13 +222,13 @@ static int file_browse_exec(bContext *C, wmOperator *op)
|
|||
/* Do this first so '//' isn't converted to '//\' on windows. */
|
||||
BLI_path_slash_ensure(path);
|
||||
if (is_relative) {
|
||||
const int path_len = BLI_strncpy_rlen(path, str, FILE_MAX);
|
||||
BLI_path_rel(path, BKE_main_blendfile_path(bmain));
|
||||
str = MEM_reallocN(str, path_len + 2);
|
||||
BLI_strncpy(str, path, FILE_MAX);
|
||||
str_len = strlen(path);
|
||||
str = MEM_reallocN(str, str_len + 1);
|
||||
memcpy(str, path, str_len + 1);
|
||||
}
|
||||
else {
|
||||
str = MEM_reallocN(str, str_len + 2);
|
||||
str = MEM_reallocN(str, str_len + 1);
|
||||
}
|
||||
}
|
||||
else {
|
||||
|
|
Loading…
Reference in New Issue