blender
/
blender
129
398
Fork 572
Code Issues 6.2k Pull Requests 749 Projects 19 Wiki Activity

Fix T89247: Dereference arguments to comparison function correctly 

`bm_face_len_cmp` incorrectly interpreted its arguments as `BMFace *`
instead of `BMFace **`, causing an out-of-bounds read.

Ref D11637
This commit is contained in:
Fen 2021-06-18 11:13:09 +10:00 committed by Campbell Barton
parent 94c4a9995e
commit e178a273fa
Notes: blender-bot 2023-10-04 09:42:55 +02:00 
Referenced by issue #88449, Blender LTS: Maintenance Task 2.93
Referenced by issue #89247, Select Similar Face Regions triggers AddressSanitizer crash
Referenced by issue #77348, Blender LTS: Maintenance Task 2.83
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
source/blender/bmesh/tools/bmesh_region_match.c
View File

@ -553,7 +553,8 @@ static void bm_uuidwalk_pass_add(UUIDWalk *uuidwalk,
static int bm_face_len_cmp(const void *v1, const void *v2)
{
const BMFace *f1 = v1, *f2 = v2;
const BMFace *f1 = *((BMFace **)v1);
const BMFace *f2 = *((BMFace **)v2);
if (f1->len > f2->len) {
return 1;