From 0a1bcc78e0b5e4d11e48b9f447fa315a86444f96 Mon Sep 17 00:00:00 2001 From: Campbell Barton Date: Sat, 6 Jul 2013 02:20:39 +0000 Subject: [PATCH] fix for writing past array end with loop filling. --- source/blender/bmesh/operators/bmo_fill_edgeloop.c | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-) diff --git a/source/blender/bmesh/operators/bmo_fill_edgeloop.c b/source/blender/bmesh/operators/bmo_fill_edgeloop.c index f80eafd4135..bd0466ff499 100644 --- a/source/blender/bmesh/operators/bmo_fill_edgeloop.c +++ b/source/blender/bmesh/operators/bmo_fill_edgeloop.c @@ -62,22 +62,19 @@ void bmo_edgeloop_fill_exec(BMesh *bm, BMOperator *op) BMO_elem_flag_enable(bm, e, EDGE_MARK); BM_ITER_ELEM (v, &viter, e, BM_VERTS_OF_EDGE) { if (BMO_elem_flag_test(bm, v, VERT_USED) == false) { + if (i == tote) { + goto cleanup; + } + BMO_elem_flag_enable(bm, v, VERT_USED); verts[i++] = v; - if (i == tote) { - break; - } } } - if (i > tote) { - break; - } } /* we have a different number of verts to edges */ if (i != tote) { - MEM_freeN(verts); - return; + goto cleanup; } /* loop over connected flagged edges and fill in faces, this is made slightly more @@ -156,5 +153,6 @@ void bmo_edgeloop_fill_exec(BMesh *bm, BMOperator *op) BMO_slot_buffer_from_enabled_flag(bm, op, op->slots_out, "faces.out", BM_FACE, ELE_OUT); } +cleanup: MEM_freeN(verts); }