Commit: 41a3ce878caaefba7737ba0e203116954cfdbb90
Author: Campbell Barton
Date: Thu Jul 16 03:00:44 2015 +1000
Branches: mathutils_bvhtree
https://developer.blender.org/rB41a3ce878caaefba7737ba0e203116954cfdbb90
Check range of triangles passed into new bvhtrees
Avoid crashesing on invalid data
===================================================================
M source/blender/python/mathutils/mathutils_bvhtree.c
===================================================================
diff --git a/source/blender/python/mathutils/mathutils_bvhtree.c
b/source/blender/python/mathutils/mathutils_bvhtree.c
index c1086dc..470f0fd 100644
--- a/source/blender/python/mathutils/mathutils_bvhtree.c
+++ b/source/blender/python/mathutils/mathutils_bvhtree.c
@@ -811,6 +811,7 @@ static int PyBVHTreeCustom__tp_init(PyBVHTree_Custom *self,
PyObject *args, PyOb
for (i = 0; i < numtris; i++) {
PyObject *py_triverts =
PySequence_Fast_GET_ITEM(py_tris_fast, i);
PyObject *py_triverts_fast =
PySequence_Fast(py_triverts, error_prefix);
+ int j;
if (py_triverts_fast == NULL) {
valid = false;
@@ -825,9 +826,21 @@ static int PyBVHTreeCustom__tp_init(PyBVHTree_Custom
*self, PyObject *args, PyOb
break;
}
- tp->tri[0] =
_PyLong_AsInt(PySequence_Fast_GET_ITEM(py_triverts_fast, 0));
- tp->tri[1] =
_PyLong_AsInt(PySequence_Fast_GET_ITEM(py_triverts_fast, 1));
- tp->tri[2] =
_PyLong_AsInt(PySequence_Fast_GET_ITEM(py_triverts_fast, 2));
+ for (j = 0; j++; j < 3) {
+ const int index =
_PyLong_AsInt(PySequence_Fast_GET_ITEM(py_triverts_fast, j));
+ if (UNLIKELY(index == -1 && PyErr_Occurred())) {
+ valid = false;
+ break;
+ }
+ else if (UNLIKELY(index < 0 || index >=
numverts)) {
+ PyErr_Format(PyExc_ValueError,
+ "Index %d out of range
[0-%d]", index, numverts);
+ valid = false;
+ break;
+ }
+
+ tp->tri[j] = index;
+ }
Py_DECREF(py_triverts_fast);
}
}
_______________________________________________
Bf-blender-cvs mailing list
[email protected]
http://lists.blender.org/mailman/listinfo/bf-blender-cvs
