Commit: ad2f210413ad7aee347bb2824369b1425113d9e1
Author: Antony Riakiotakis
Date:   Sat Dec 5 19:34:04 2015 +0100
Branches: wiggly-widgets
https://developer.blender.org/rBad2f210413ad7aee347bb2824369b1425113d9e1

Fix memory header corruption, report and cause found by Julian, thanks!

===================================================================

M       source/blender/blenkernel/intern/cdderivedmesh.c
M       source/blender/blenkernel/intern/subsurf_ccg.c

===================================================================

diff --git a/source/blender/blenkernel/intern/cdderivedmesh.c 
b/source/blender/blenkernel/intern/cdderivedmesh.c
index 8e1544b..2cad0b8 100644
--- a/source/blender/blenkernel/intern/cdderivedmesh.c
+++ b/source/blender/blenkernel/intern/cdderivedmesh.c
@@ -1610,7 +1610,8 @@ static void cdDM_buffer_copy_facemap(DerivedMesh *dm, 
unsigned int *varray)
        facemap_iter = facemap;
        mp_iter = mp;
        for (i = 0; i < totpoly; i++, facemap_iter++, mp_iter++) {
-               gdo->facemap_count[*facemap_iter] += ME_POLY_TRI_TOT(mp_iter);
+               if (*facemap_iter != -1)
+                       gdo->facemap_count[*facemap_iter] += 
ME_POLY_TRI_TOT(mp_iter);
        }
 
        for (i = 0; i < gdo->totfacemaps; i++) {
@@ -1621,16 +1622,18 @@ static void cdDM_buffer_copy_facemap(DerivedMesh *dm, 
unsigned int *varray)
        facemap_iter = facemap;
        mp_iter = mp;
        for (i = 0; i < totpoly; i++, facemap_iter++, mp_iter++) {
-               int numtri = ME_POLY_TRI_TOT(mp_iter);
-               int fmap_offset = (gdo->facemap_start[*facemap_iter] + 
facemap_offset[*facemap_iter]) * 3;
-               const MLoopTri *ltri_iter = ltri + poly_to_tri_count(i, 
mp_iter->loopstart);
+               if (*facemap_iter != -1) {
+                       int numtri = ME_POLY_TRI_TOT(mp_iter);
+                       int fmap_offset = (gdo->facemap_start[*facemap_iter] + 
facemap_offset[*facemap_iter]) * 3;
+                       const MLoopTri *ltri_iter = ltri + poly_to_tri_count(i, 
mp_iter->loopstart);
 
-               facemap_offset[*facemap_iter] += numtri;
+                       facemap_offset[*facemap_iter] += numtri;
 
-               for (; numtri > 0; numtri--, ltri_iter++) {
-                       varray[fmap_offset++] = 
gdo->vert_points[mloop[ltri_iter->tri[0]].v].point_index;
-                       varray[fmap_offset++] = 
gdo->vert_points[mloop[ltri_iter->tri[1]].v].point_index;
-                       varray[fmap_offset++] = 
gdo->vert_points[mloop[ltri_iter->tri[2]].v].point_index;
+                       for (; numtri > 0; numtri--, ltri_iter++) {
+                               varray[fmap_offset++] = 
gdo->vert_points[mloop[ltri_iter->tri[0]].v].point_index;
+                               varray[fmap_offset++] = 
gdo->vert_points[mloop[ltri_iter->tri[1]].v].point_index;
+                               varray[fmap_offset++] = 
gdo->vert_points[mloop[ltri_iter->tri[2]].v].point_index;
+                       }
                }
        }
 
diff --git a/source/blender/blenkernel/intern/subsurf_ccg.c 
b/source/blender/blenkernel/intern/subsurf_ccg.c
index 3303cc6..13ccc5d 100644
--- a/source/blender/blenkernel/intern/subsurf_ccg.c
+++ b/source/blender/blenkernel/intern/subsurf_ccg.c
@@ -2139,9 +2139,12 @@ static void ccgDM_buffer_copy_facemaps(DerivedMesh *dm, 
unsigned int *varray)
        facemap_offset = MEM_callocN(gdo->totfacemaps * 
sizeof(*facemap_offset), "facemap_offset");
 
        for (i = 0; i < totface; i++) {
-               CCGFace *f = ccgdm->faceMap[i].face;
-               int numVerts = ccgSubSurf_getFaceNumVerts(f);
-               gdo->facemap_count[facemap[ccgdm->faceMap[i].startFace]] += 
gridFaces * gridFaces * numVerts * 2;
+               int facemap_index = facemap[ccgdm->faceMap[i].startFace];
+               if (facemap_index != -1) {
+                       CCGFace *f = ccgdm->faceMap[i].face;
+                       int numVerts = ccgSubSurf_getFaceNumVerts(f);
+                       gdo->facemap_count[facemap_index] += gridFaces * 
gridFaces * numVerts * 2;
+               }
        }
 
        for (i = 0; i < gdo->totfacemaps; i++) {
@@ -2150,25 +2153,27 @@ static void ccgDM_buffer_copy_facemaps(DerivedMesh *dm, 
unsigned int *varray)
        }
 
        for (i = 0; i < totface; i++) {
-               CCGFace *f = ccgdm->faceMap[i].face;
-               int S, x, y, numVerts = ccgSubSurf_getFaceNumVerts(f);
                int facemap_index = facemap[ccgdm->faceMap[i].startFace];
-               int fmap_offset = (gdo->facemap_start[facemap_index] + 
facemap_offset[facemap_index]) * 3;
+               if (facemap_index != -1) {
+                       CCGFace *f = ccgdm->faceMap[i].face;
+                       int S, x, y, numVerts = ccgSubSurf_getFaceNumVerts(f);
+                       int fmap_offset = (gdo->facemap_start[facemap_index] + 
facemap_offset[facemap_index]) * 3;
 
-               facemap_offset[facemap_index] += gridFaces * gridFaces * 
numVerts * 2;
+                       facemap_offset[facemap_index] += gridFaces * gridFaces 
* numVerts * 2;
 
-               for (S = 0; S < numVerts; S++) {
-                       for (y = 0; y < gridFaces; y++) {
-                               for (x = 0; x < gridFaces; x++) {
-                                       varray[fmap_offset++] = totloops + 3;
-                                       varray[fmap_offset++] = totloops + 2;
-                                       varray[fmap_offset++] = totloops + 1;
+                       for (S = 0; S < numVerts; S++) {
+                               for (y = 0; y < gridFaces; y++) {
+                                       for (x = 0; x < gridFaces; x++) {
+                                               varray[fmap_offset++] = 
totloops + 3;
+                                               varray[fmap_offset++] = 
totloops + 2;
+                                               varray[fmap_offset++] = 
totloops + 1;
 
-                                       varray[fmap_offset++] = totloops + 3;
-                                       varray[fmap_offset++] = totloops + 1;
-                                       varray[fmap_offset++] = totloops;
+                                               varray[fmap_offset++] = 
totloops + 3;
+                                               varray[fmap_offset++] = 
totloops + 1;
+                                               varray[fmap_offset++] = 
totloops;
 
-                                       totloops += 4;
+                                               totloops += 4;
+                                       }
                                }
                        }
                }

_______________________________________________
Bf-blender-cvs mailing list
Bf-blender-cvs@blender.org
http://lists.blender.org/mailman/listinfo/bf-blender-cvs

Reply via email to