kannonier8/blender
1
0
Fork 0
forked from bartvdbraak/blender
Code Pull Requests Activity

Fix T47644: crash (use-after-free) regression from rB7a74738914a66e.

Browse Source 
Handling `me` data here is not good idea anyway, we override it completly with data
from `tmp` (crash came from freeing already existing bb from me, while pointer still existed in tmp).

(rediscovered it while working on T47676...).

To be backported to 2.77.
This commit is contained in:
Bastien Montagne 2016-03-03 14:44:05 +01:00
parent adafcda0bd
commit b47137ae46
1 changed files with 3 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
source/blender/blenkernel/intern/DerivedMesh.c
View File

@ -808,13 +808,12 @@ void DM_to_mesh(DerivedMesh *dm, Mesh *me, Object *ob, CustomDataMask mask, bool
}
/* Clear selection history */
tmp.mselect = NULL;
MEM_SAFE_FREE(tmp.mselect);
tmp.totselect = 0;
if (me->mselect) {
MEM_freeN(me->mselect);
}
BLI_assert(ELEM(tmp.bb, NULL, me->bb));
if (me->bb) {
MEM_freeN(me->bb);
tmp.bb = NULL;
}
/* skip the listbase */