Commit: bddd9d809d2c291eb0a92220195908c51ae2ce80
Author: lazydodo
Date:   Fri May 26 06:26:21 2017 -0600
Branches: master
https://developer.blender.org/rBbddd9d809d2c291eb0a92220195908c51ae2ce80

Fix integer overflows in meshcache modifier.

Differential Revision: https://developer.blender.org/D2688

===================================================================

M       source/blender/modifiers/intern/MOD_meshcache_mdd.c
M       source/blender/modifiers/intern/MOD_meshcache_pc2.c

===================================================================

diff --git a/source/blender/modifiers/intern/MOD_meshcache_mdd.c 
b/source/blender/modifiers/intern/MOD_meshcache_mdd.c
index 90fc750de3b..3dd3a5fc598 100644
--- a/source/blender/modifiers/intern/MOD_meshcache_mdd.c
+++ b/source/blender/modifiers/intern/MOD_meshcache_mdd.c
@@ -35,6 +35,9 @@
 #ifdef __LITTLE_ENDIAN__
 #  include "BLI_endian_switch.h"
 #endif
+#ifdef WIN32
+#  include "BLI_winstuff.h"
+#endif
 
 #include "MOD_meshcache_util.h"  /* own include */
 
@@ -157,7 +160,7 @@ bool MOD_meshcache_read_mdd_index(FILE *fp,
                return false;
        }
 
-       if (fseek(fp, index * mdd_head.verts_tot * sizeof(float) * 3, SEEK_CUR) 
!= 0) {
+       if (fseek(fp, sizeof(float) * 3 * index * mdd_head.verts_tot, SEEK_CUR) 
!= 0) {
                *err_str = "Failed to seek frame";
                return false;
        }
diff --git a/source/blender/modifiers/intern/MOD_meshcache_pc2.c 
b/source/blender/modifiers/intern/MOD_meshcache_pc2.c
index 219eae4ecca..8360c8ffda7 100644
--- a/source/blender/modifiers/intern/MOD_meshcache_pc2.c
+++ b/source/blender/modifiers/intern/MOD_meshcache_pc2.c
@@ -35,6 +35,10 @@
 #  include "BLI_endian_switch.h"
 #endif
 
+#ifdef WIN32
+#  include "BLI_winstuff.h"
+#endif
+
 #include "MOD_meshcache_util.h"  /* own include */
 
 #include "DNA_modifier_types.h"
@@ -142,7 +146,7 @@ bool MOD_meshcache_read_pc2_index(FILE *fp,
                return false;
        }
 
-       if (fseek(fp, index * pc2_head.verts_tot * sizeof(float) * 3, SEEK_CUR) 
!= 0) {
+       if (fseek(fp, sizeof(float) * 3 * index * pc2_head.verts_tot , 
SEEK_CUR) != 0) {
                *err_str = "Failed to seek frame";
                return false;
        }

_______________________________________________
Bf-blender-cvs mailing list
Bf-blender-cvs@blender.org
https://lists.blender.org/mailman/listinfo/bf-blender-cvs

Reply via email to