Commit: 8dd18a77e72444c5a9cc60c1043fa96b28260d9a
Author: Fen
Date: Fri Jun 18 11:13:09 2021 +1000
Branches: blender-v2.83-release
https://developer.blender.org/rB8dd18a77e72444c5a9cc60c1043fa96b28260d9a
Fix T89247: Dereference arguments to comparison function correctly
`bm_face_len_cmp` incorrectly interpreted its arguments as `BMFace *`
instead of `BMFace **`, causing an out-of-bounds read.
Ref D11637
===================================================================
M source/blender/bmesh/tools/bmesh_region_match.c
===================================================================
diff --git a/source/blender/bmesh/tools/bmesh_region_match.c
b/source/blender/bmesh/tools/bmesh_region_match.c
index 44761b9f37e..67219dbd8cb 100644
--- a/source/blender/bmesh/tools/bmesh_region_match.c
+++ b/source/blender/bmesh/tools/bmesh_region_match.c
@@ -561,7 +561,8 @@ static void bm_uuidwalk_pass_add(UUIDWalk *uuidwalk,
static int bm_face_len_cmp(const void *v1, const void *v2)
{
- const BMFace *f1 = v1, *f2 = v2;
+ const BMFace *f1 = *((BMFace **)v1);
+ const BMFace *f2 = *((BMFace **)v2);
if (f1->len > f2->len) {
return 1;
_______________________________________________
Bf-blender-cvs mailing list
[email protected]
List details, subscription details or unsubscribe:
https://lists.blender.org/mailman/listinfo/bf-blender-cvs
