From d3e16df4f19b4af219e46d9d3e517bba82b53494 Mon Sep 17 00:00:00 2001 From: Sergey Sharybin Date: Sat, 13 Jun 2015 18:43:14 +0200 Subject: [PATCH] Cycles: Solve possible buffer overrun when using too much closures Glass BSDF was doing some magic with copying weigths from initial closure onto refraction one and the code was not checking properly for the number of closures. --- intern/cycles/kernel/svm/svm_closure.h | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/intern/cycles/kernel/svm/svm_closure.h b/intern/cycles/kernel/svm/svm_closure.h index 7cdcbc2d30c..20a6cb8cd45 100644 --- a/intern/cycles/kernel/svm/svm_closure.h +++ b/intern/cycles/kernel/svm/svm_closure.h @@ -285,15 +285,17 @@ ccl_device void svm_node_closure_bsdf(KernelGlobals *kg, ShaderData *sd, float * #endif /* refraction */ - sc = ccl_fetch_array(sd, closure, ccl_fetch(sd, num_closure)); - sc->weight = weight; - sc->sample_weight = sample_weight; + if(ccl_fetch(sd, num_closure) < MAX_CLOSURE) { + sc = ccl_fetch_array(sd, closure, ccl_fetch(sd, num_closure)); + sc->weight = weight; + sc->sample_weight = sample_weight; - sc = svm_node_closure_get_bsdf(sd, mix_weight*(1.0f - fresnel)); + sc = svm_node_closure_get_bsdf(sd, mix_weight*(1.0f - fresnel)); - if(sc) { - sc->N = N; - svm_node_glass_setup(sd, sc, type, eta, roughness, true); + if(sc) { + sc->N = N; + svm_node_glass_setup(sd, sc, type, eta, roughness, true); + } } break;