Fix T51900: Crash after pressing "F" multiple times.
authorBastien Montagne <montagne29@wanadoo.fr>
Wed, 28 Jun 2017 08:53:52 +0000 (10:53 +0200)
committerBastien Montagne <montagne29@wanadoo.fr>
Wed, 28 Jun 2017 08:53:52 +0000 (10:53 +0200)
`BMO_iter_as_array()` may fill less items than requested in given array,
so we have to update number of items to work on from its returned value,
otherwise code might try to use uninitialized memory.

source/blender/bmesh/operators/bmo_create.c

index a980baf8626990093cd70ea7b1ec4e8d7f09a1bf..20b8a481ede4a03bbe482a6d81612745ec572e86 100644 (file)
@@ -74,13 +74,13 @@ void bmo_contextual_create_exec(BMesh *bm, BMOperator *op)
                BMVert *verts[2];
                BMEdge *e;
 
-               BMO_iter_as_array(op->slots_in, "geom", BM_VERT, (void **)verts, 2);
-
-               /* create edge */
-               e = BM_edge_create(bm, verts[0], verts[1], NULL, BM_CREATE_NO_DOUBLE);
-               BMO_edge_flag_enable(bm, e, ELE_OUT);
-               tote += 1;
-               BMO_slot_buffer_from_enabled_flag(bm, op, op->slots_out, "edges.out", BM_EDGE, ELE_OUT);
+               if (BMO_iter_as_array(op->slots_in, "geom", BM_VERT, (void **)verts, 2) == 0) {
+                       /* create edge */
+                       e = BM_edge_create(bm, verts[0], verts[1], NULL, BM_CREATE_NO_DOUBLE);
+                       BMO_edge_flag_enable(bm, e, ELE_OUT);
+                       tote += 1;
+                       BMO_slot_buffer_from_enabled_flag(bm, op, op->slots_out, "edges.out", BM_EDGE, ELE_OUT);
+               }
                return;
        }
 
@@ -283,13 +283,13 @@ void bmo_contextual_create_exec(BMesh *bm, BMOperator *op)
         */
        if (totv > 2) {
                /* TODO, some of these vertes may be connected by edges,
-                * this connectivity could be used rather then treating
+                * this connectivity could be used rather than treating
                 * them as a bunch of isolated verts. */
 
                BMVert **vert_arr = MEM_mallocN(sizeof(BMVert *) * totv, __func__);
                BMFace *f;
 
-               BMO_iter_as_array(op->slots_in, "geom", BM_VERT, (void **)vert_arr, totv);
+               totv = BMO_iter_as_array(op->slots_in, "geom", BM_VERT, (void **)vert_arr, totv);
 
                BM_verts_sort_radial_plane(vert_arr, totv);