From 9371a800b7855648469a58a0ef4ddb08eaf943cf Mon Sep 17 00:00:00 2001 From: Campbell Barton Date: Wed, 24 Nov 2010 21:33:07 +0000 Subject: [PATCH] drivers could reference invalid index values outside the bounds of the array. --- source/blender/blenkernel/intern/fcurve.c | 39 +++++++++++++++-------- 1 file changed, 26 insertions(+), 13 deletions(-) diff --git a/source/blender/blenkernel/intern/fcurve.c b/source/blender/blenkernel/intern/fcurve.c index 2f886d8ab43..888eae3ed78 100644 --- a/source/blender/blenkernel/intern/fcurve.c +++ b/source/blender/blenkernel/intern/fcurve.c @@ -934,31 +934,44 @@ static float dtar_get_prop_val (ChannelDriver *driver, DriverTarget *dtar) /* get property to read from, and get value as appropriate */ if (RNA_path_resolve_full(&id_ptr, dtar->rna_path, &ptr, &prop, &index)) { - switch (RNA_property_type(prop)) { - case PROP_BOOLEAN: - if (RNA_property_array_length(&ptr, prop)) + if(RNA_property_array_check(&ptr, prop)) { + /* array */ + if (index < RNA_property_array_length(&ptr, prop)) { + switch (RNA_property_type(prop)) { + case PROP_BOOLEAN: value= (float)RNA_property_boolean_get_index(&ptr, prop, index); - else - value= (float)RNA_property_boolean_get(&ptr, prop); + break; + case PROP_INT: + value= (float)RNA_property_int_get_index(&ptr, prop, index); + break; + case PROP_FLOAT: + value= RNA_property_float_get_index(&ptr, prop, index); + break; + default: + break; + } + } + } + else { + /* not an array */ + switch (RNA_property_type(prop)) { + case PROP_BOOLEAN: + value= (float)RNA_property_boolean_get(&ptr, prop); break; case PROP_INT: - if (RNA_property_array_length(&ptr, prop)) - value= (float)RNA_property_int_get_index(&ptr, prop, index); - else - value= (float)RNA_property_int_get(&ptr, prop); + value= (float)RNA_property_int_get(&ptr, prop); break; case PROP_FLOAT: - if (RNA_property_array_length(&ptr, prop)) - value= RNA_property_float_get_index(&ptr, prop, index); - else - value= RNA_property_float_get(&ptr, prop); + value= RNA_property_float_get(&ptr, prop); break; case PROP_ENUM: value= (float)RNA_property_enum_get(&ptr, prop); break; default: break; + } } + } else { if (G.f & G_DEBUG)