forked from bartvdbraak/blender
Fix T47644: crash (use-after-free) regression from rB7a74738914a66e.
Handling `me` data here is not good idea anyway, we override it completly with data from `tmp` (crash came from freeing already existing bb from me, while pointer still existed in tmp). (rediscovered it while working on T47676...). To be backported to 2.77.
This commit is contained in:
parent
adafcda0bd
commit
b47137ae46
@ -808,13 +808,12 @@ void DM_to_mesh(DerivedMesh *dm, Mesh *me, Object *ob, CustomDataMask mask, bool
|
||||
}
|
||||
|
||||
/* Clear selection history */
|
||||
tmp.mselect = NULL;
|
||||
MEM_SAFE_FREE(tmp.mselect);
|
||||
tmp.totselect = 0;
|
||||
if (me->mselect) {
|
||||
MEM_freeN(me->mselect);
|
||||
}
|
||||
BLI_assert(ELEM(tmp.bb, NULL, me->bb));
|
||||
if (me->bb) {
|
||||
MEM_freeN(me->bb);
|
||||
tmp.bb = NULL;
|
||||
}
|
||||
|
||||
/* skip the listbase */
|
||||
|
Loading…
Reference in New Issue
Block a user