blender
/
blender
129
398
Fork 572
Code Issues 6.2k Pull Requests 748 Projects 19 Wiki Activity

Fix T86106: bpy.types.SpaceView3D.draw_handler_remove(...) causes Blender to crash 

The handle of a drawing callback can be removed within the drawing function itself.

This causes `var = (type)(((Link *)(var))->next` to read an invalid memory value in C.
This commit is contained in:
Germano Cavalcante 2021-03-08 10:29:57 -03:00 committed by Germano Cavalcante
parent 171ba42439
commit b6c07d69e2
Notes: blender-bot 2023-02-14 06:42:53 +01:00 
Referenced by issue #86106, bpy.types.SpaceView3D.draw_handler_remove(...) causes Blender to crash
2 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
source/blender/editors/space_api/spacetypes.c
View File

@ -262,7 +262,7 @@ void ED_region_draw_cb_exit(ARegionType *art, void *handle)
void ED_region_draw_cb_draw(const bContext *C, ARegion *region, int type)
{
LISTBASE_FOREACH (RegionDrawCB *, rdc, &region->type->drawcalls) {
LISTBASE_FOREACH_MUTABLE (RegionDrawCB *, rdc, &region->type->drawcalls) {
if (rdc->type == type) {
rdc->draw(C, region, rdc->customdata);

2
source/blender/windowmanager/intern/wm_draw.c
View File

@ -98,7 +98,7 @@ static void wm_paintcursor_draw(bContext *C, ScrArea *area, ARegion *region)
return;
}
LISTBASE_FOREACH (wmPaintCursor *, pc, &wm->paintcursors) {
LISTBASE_FOREACH_MUTABLE (wmPaintCursor *, pc, &wm->paintcursors) {
if ((pc->space_type != SPACE_TYPE_ANY) && (area->spacetype != pc->space_type)) {
continue;
}