sandey/blender
1
0
Fork 0
forked from bartvdbraak/blender
Code Pull Requests Activity

fix for python api bug: assigning the wrong size array to an RNA property wasn't checking the length and could crash, eg:

Browse Source 
mesh.polygons[0].vertices = (10,)
This commit is contained in:
Campbell Barton 2013-06-27 01:01:11 +00:00
parent 8107c543ec
commit 46808dd22c
1 changed files with 12 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
source/blender/python/intern/bpy_rna_array.c
View File

@ -74,13 +74,14 @@ static int validate_array_type(PyObject *seq, int dim, int totdim, int dimsize[]
/* not the last dimension */ /* not the last dimension */
if (dim + 1 < totdim) { if (dim + 1 < totdim) {
/* check that a sequence contains dimsize[dim] items */ /* check that a sequence contains dimsize[dim] items */
const Py_ssize_t seq_size = PySequence_Size(seq); const int seq_size = PySequence_Size(seq);
if (seq_size == -1) { if (seq_size == -1) {
PyErr_Format(PyExc_ValueError, "%s sequence expected at dimension %d, not '%s'", PyErr_Format(PyExc_ValueError, "%s sequence expected at dimension %d, not '%s'",
error_prefix, dim + 1, Py_TYPE(seq)->tp_name); error_prefix, dim + 1, Py_TYPE(seq)->tp_name);
return -1; return -1;
} }
for (i = 0; i < seq_size; i++) { for (i = 0; i < seq_size; i++) {
Py_ssize_t item_seq_size;
PyObject *item; PyObject *item;
int ok = 1; int ok = 1;
item = PySequence_GetItem(seq, i); item = PySequence_GetItem(seq, i);
@ -90,7 +91,7 @@ static int validate_array_type(PyObject *seq, int dim, int totdim, int dimsize[]
error_prefix, Py_TYPE(seq)->tp_name, i); error_prefix, Py_TYPE(seq)->tp_name, i);
ok = 0; ok = 0;
} }
else if (!PySequence_Check(item)) { else if ((item_seq_size = PySequence_Size(item)) == -1) {
/* BLI_snprintf(error_str, error_str_size, "expected a sequence of %s", item_type_str); */ /* BLI_snprintf(error_str, error_str_size, "expected a sequence of %s", item_type_str); */
PyErr_Format(PyExc_TypeError, "%s expected a sequence of %s, not %s", PyErr_Format(PyExc_TypeError, "%s expected a sequence of %s, not %s",
error_prefix, item_type_str, Py_TYPE(item)->tp_name); error_prefix, item_type_str, Py_TYPE(item)->tp_name);
@ -101,12 +102,12 @@ static int validate_array_type(PyObject *seq, int dim, int totdim, int dimsize[]
* dimsize[2] = 5 * dimsize[2] = 5
* *
* dim = 0 */ * dim = 0 */
else if (PySequence_Size(item) != dimsize[dim + 1]) { else if (item_seq_size != dimsize[dim + 1]) {
/* BLI_snprintf(error_str, error_str_size, /* BLI_snprintf(error_str, error_str_size,
* "sequences of dimension %d should contain %d items", * "sequences of dimension %d should contain %d items",
* dim + 1, dimsize[dim + 1]); */ * dim + 1, dimsize[dim + 1]); */
PyErr_Format(PyExc_ValueError, "%s sequences of dimension %d should contain %d items", PyErr_Format(PyExc_ValueError, "%s sequences of dimension %d should contain %d items, not %d",
error_prefix, dim + 1, dimsize[dim + 1]); error_prefix, dim + 1, dimsize[dim + 1], item_seq_size);
ok = 0; ok = 0;
} }
else if (validate_array_type(item, dim + 1, totdim, dimsize, check_item_type, item_type_str, error_prefix) == -1) { else if (validate_array_type(item, dim + 1, totdim, dimsize, check_item_type, item_type_str, error_prefix) == -1) {
@ -128,6 +129,12 @@ static int validate_array_type(PyObject *seq, int dim, int totdim, int dimsize[]
error_prefix, dim + 1, Py_TYPE(seq)->tp_name); error_prefix, dim + 1, Py_TYPE(seq)->tp_name);
return -1; return -1;
} }
else if (seq_size != dimsize[dim]) {
PyErr_Format(PyExc_ValueError, "%s sequences of dimension %d should contain %d items, not %d",
error_prefix, dim, dimsize[dim], seq_size);
return -1;
}
for (i = 0; i < seq_size; i++) { for (i = 0; i < seq_size; i++) {
PyObject *item = PySequence_GetItem(seq, i); PyObject *item = PySequence_GetItem(seq, i);