kannonier8/blender
1
0
Fork 0
forked from bartvdbraak/blender
Code Pull Requests Activity

Fix possible buffer overflow in selection code. We want to copy the

Browse Source 
number of selected data since the offset, not the offset!
This commit is contained in:
Antony Riakiotakis 2014-09-23 19:05:31 +02:00
parent e422e56db0
commit 3906782406
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
source/blender/editors/space_view3d/view3d_select.c
View File

@ -1181,14 +1181,14 @@ static short selectbuffer_ret_hits_15(unsigned int *UNUSED(buffer), const short
static short selectbuffer_ret_hits_9(unsigned int *buffer, const short hits15, const short hits9) static short selectbuffer_ret_hits_9(unsigned int *buffer, const short hits15, const short hits9)
{ {
const int offs = 4 * hits15; const int offs = 4 * hits15;
memcpy(buffer, buffer + offs, 4 * offs); memcpy(buffer, buffer + offs, 4 * hits9);
return hits9; return hits9;
} }
static short selectbuffer_ret_hits_5(unsigned int *buffer, const short hits15, const short hits9, const short hits5) static short selectbuffer_ret_hits_5(unsigned int *buffer, const short hits15, const short hits9, const short hits5)
{ {
const int offs = 4 * hits15 + 4 * hits9; const int offs = 4 * hits15 + 4 * hits9;
memcpy(buffer, buffer + offs, 4 * offs); memcpy(buffer, buffer + offs, 4 * hits5);
return hits5; return hits5;
} }