kannonier8/blender
1
0
Fork 0
forked from bartvdbraak/blender
Code Pull Requests Activity

fix for crash reading pointcache, was reading over the buffer size, use lzo1x_decompress_safe rather then lzo1x_decompress

Browse Source
This commit is contained in:
Campbell Barton 2010-05-11 19:37:17 +00:00
parent c3dbd2a46b
commit 3409eb429e
2 changed files with 18 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

30
source/blender/blenkernel/intern/pointcache.c
View File

@ -812,23 +812,27 @@ static int ptcache_compress_read(PTCacheFile *pf, unsigned char *result, unsigne
ptcache_file_read(pf, &compressed, 1, sizeof(unsigned char));
if(compressed) {
ptcache_file_read(pf, &in_len, 1, sizeof(unsigned int));
in = (unsigned char *)MEM_callocN(sizeof(unsigned char)*in_len, "pointcache_compressed_buffer");
ptcache_file_read(pf, in, in_len, sizeof(unsigned char));
if(in_len==0) {
/* do nothing */
}
else {
in = (unsigned char *)MEM_callocN(sizeof(unsigned char)*in_len, "pointcache_compressed_buffer");
ptcache_file_read(pf, in, in_len, sizeof(unsigned char));
#ifdef WITH_LZO
if(compressed == 1)
r = lzo1x_decompress(in, (lzo_uint)in_len, result, (lzo_uint *)&out_len, NULL);
if(compressed == 1)
r = lzo1x_decompress_safe(in, (lzo_uint)in_len, result, (lzo_uint *)&out_len, NULL);
#endif
#ifdef WITH_LZMA
if(compressed == 2)
{
size_t leni = in_len, leno = out_len;
ptcache_file_read(pf, &sizeOfIt, 1, sizeof(unsigned int));
ptcache_file_read(pf, props, sizeOfIt, sizeof(unsigned char));
r = LzmaUncompress(result, &leno, in, &leni, props, sizeOfIt);
}
if(compressed == 2)
{
size_t leni = in_len, leno = out_len;
ptcache_file_read(pf, &sizeOfIt, 1, sizeof(unsigned int));
ptcache_file_read(pf, props, sizeOfIt, sizeof(unsigned char));
r = LzmaUncompress(result, &leno, in, &leni, props, sizeOfIt);
}
#endif
MEM_freeN(in);
MEM_freeN(in);
}
}
else {
ptcache_file_read(pf, result, len, sizeof(unsigned char));

2
source/blender/makesrna/intern/rna_object_force.c
View File

@ -749,7 +749,7 @@ static void rna_def_pointcache(BlenderRNA *brna)
prop= RNA_def_property(srna, "use_library_path", PROP_BOOLEAN, PROP_NONE);
RNA_def_property_boolean_negative_sdna(prop, NULL, "flag", PTCACHE_IGNORE_LIBPATH);
RNA_def_property_ui_text(prop, "Library Path", "Use this files path when library linked indo another file.");
RNA_def_property_ui_text(prop, "Library Path", "Use this files path when library linked into another file.");
RNA_def_property_update(prop, NC_OBJECT, "rna_Cache_idname_change");
prop= RNA_def_property(srna, "point_cache_list", PROP_COLLECTION, PROP_NONE);