- possibly bugfix /w uninitialized vars [#23270] Long directory name segmentation fault in File brower.

- in exceptional cases vertcos_to_key() could return with KeyBlock pointing to freed memory.
- invalid use of realloc() in BLI_builddir()

4 files changed, 22 insertions, 8 deletions

diff --git a/source/blender/blenkernel/intern/key.c b/source/blender/blenkernel/intern/key.c
index 354b3b0e7d8..f4b931ec52b 100644
--- a/source/blender/blenkernel/intern/key.c
+++ b/source/blender/blenkernel/intern/key.c
@@ -1850,9 +1850,12 @@ void vertcos_to_key(Object *ob, KeyBlock *kb, float (*vertCos)[3])
 		tot= count_curveverts(&cu->nurb);
 	}
 
-	fp= kb->data= MEM_callocN(tot*elemsize, "key_to_vertcos vertCos");
+	if (tot == 0) {
+		kb->data= NULL;
+		return;
+	}
 
-	if (tot == 0) return;
+	fp= kb->data= MEM_callocN(tot*elemsize, "key_to_vertcos vertCos");
 
 	/* Copy coords to keyblock */
 
diff --git a/source/blender/blenlib/intern/storage.c b/source/blender/blenlib/intern/storage.c
index edb6aecabb1..80310b1ef8a 100644
--- a/source/blender/blenlib/intern/storage.c
+++ b/source/blender/blenlib/intern/storage.c
@@ -237,8 +237,19 @@ void BLI_builddir(char *dirname, char *relname)
 		
 		if (newnum){
 
-			if (files) files=(struct direntry *)realloc(files,(totnum+newnum) * sizeof(struct direntry));
-			else files=(struct direntry *)malloc(newnum * sizeof(struct direntry));
+			if(files) {
+				void *tmp= realloc(files, (totnum+newnum) * sizeof(struct direntry));
+				if(tmp) {
+					files= (struct direntry *)tmp;
+				}
+				else { /* realloc fail */
+					free(files);
+					files= NULL;
+				}
+			}
+			
+			if(files==NULL)
+				files=(struct direntry *)malloc(newnum * sizeof(struct direntry));
 
 			if (files){
 				dlink = (struct dirlink *) dirbase->first;
diff --git a/source/blender/imbuf/intern/thumbs.c b/source/blender/imbuf/intern/thumbs.c
index 1624e9c2b01..a2880b98856 100644
--- a/source/blender/imbuf/intern/thumbs.c
+++ b/source/blender/imbuf/intern/thumbs.c
@@ -248,8 +248,8 @@ ImBuf* IMB_thumb_create(const char* path, ThumbSize size, ThumbSource source, Im
 	char tdir[FILE_MAX];
 	char temp[FILE_MAX];
 	char mtime[40]= "0"; /* incase we can't stat the file */
-	char cwidth[40];
-	char cheight[40];
+	char cwidth[40]= "0"; /* incase images have no data */
+	char cheight[40]= "0";
 	char thumb[40];
 	short tsize = 128;
 	short ex, ey;
diff --git a/source/blender/python/doc/sphinx_doc_gen.py b/source/blender/python/doc/sphinx_doc_gen.py
index 492f66e3295..940b5fbcce9 100644
--- a/source/blender/python/doc/sphinx_doc_gen.py
+++ b/source/blender/python/doc/sphinx_doc_gen.py
@@ -269,11 +269,11 @@ def pymodule2sphinx(BASEPATH, module_name, module, title):
         descr_items = [(key, descr) for key, descr in sorted(value.__dict__.items()) if not key.startswith("__")]
 
         for key, descr in descr_items:
-            if type(descr) == ClassMethodDescriptorType: # GetSetDescriptorType's are not documented yet
+            if type(descr) == ClassMethodDescriptorType:
                 py_descr2sphinx("   ", fw, descr, module_name, type_name, key)
 
         for key, descr in descr_items:
-            if type(descr) == MethodDescriptorType: # GetSetDescriptorType's are not documented yet
+            if type(descr) == MethodDescriptorType:
                 py_descr2sphinx("   ", fw, descr, module_name, type_name, key)
 
         for key, descr in descr_items: