fix reading past array bounds for nearest_uv_between() and draw_tracking_tracks().
authorCampbell Barton <ideasman42@gmail.com>
Sat, 6 Oct 2012 12:00:54 +0000 (12:00 +0000)
committerCampbell Barton <ideasman42@gmail.com>
Sat, 6 Oct 2012 12:00:54 +0000 (12:00 +0000)
source/blender/editors/space_clip/clip_draw.c
source/blender/editors/uvedit/uvedit_ops.c

index b22c9a60bdc5b056d271bb346137b3a3d2f240bd..5e940df2a30e11812a099734de33385acb8e43ba 100644 (file)
@@ -1126,7 +1126,7 @@ static void draw_tracking_tracks(SpaceClip *sc, ARegion *ar, MovieClip *clip,
 
                                if (MARKER_VISIBLE(sc, track, marker)) {
                                        float npos[2];
-                                       copy_v4_v4(vec, track->bundle_pos);
+                                       copy_v3_v3(vec, track->bundle_pos);
                                        vec[3] = 1;
 
                                        mul_v4_m4v4(pos, mat, vec);
index f732808fa59396d307c0554f97aa04deafaec8d5..6e655faf35f14ae7b5db88b201fc6f9df9084335 100644 (file)
@@ -759,14 +759,13 @@ static int nearest_uv_between(BMEditMesh *em, BMFace *efa, int UNUSED(nverts), i
        BMLoop *l;
        MLoopUV *luv;
        BMIter iter;
-       float m[3], v1[3], v2[3], c1, c2, *uv1 = NULL, /* *uv2, */ /* UNUSED */ *uv3 = NULL;
+       float m[2], v1[2], v2[2], c1, c2, *uv1 = NULL, /* *uv2, */ /* UNUSED */ *uv3 = NULL;
        int id1, id2, i;
 
        id1 = (id + efa->len - 1) % efa->len;
        id2 = (id + efa->len + 1) % efa->len;
 
-       m[0] = co[0] - uv[0];
-       m[1] = co[1] - uv[1];
+       sub_v2_v2v2(m, co, uv);
 
        i = 0;
        BM_ITER_ELEM (l, &iter, efa, BM_LOOPS_OF_FACE) {
@@ -782,8 +781,8 @@ static int nearest_uv_between(BMEditMesh *em, BMFace *efa, int UNUSED(nverts), i
                i++;
        }
 
-       sub_v3_v3v3(v1, uv1, uv);
-       sub_v3_v3v3(v2, uv3, uv);
+       sub_v2_v2v2(v1, uv1, uv);
+       sub_v2_v2v2(v2, uv3, uv);
 
        /* m and v2 on same side of v-v1? */
        c1 = v1[0] * m[1] - v1[1] * m[0];