diff options
| author | Lukas Tönne <lukas.toenne@gmail.com> | 2013-12-09 14:02:41 +0400 |
|---|---|---|
| committer | Lukas Tönne <lukas.toenne@gmail.com> | 2013-12-09 14:06:23 +0400 |
| commit | 793b73edc269e7e801c2e72f4ae6d11951608f74 (patch) | |
| tree | a8bf43cdc9a58ae9a9d46861a72ffc852ed8ff78 | |
| parent | 5245900ddedb91cec930226a8eabd85db94dc64c (diff) | |
Fix T37712: Point cache index lookup crashed with 0 points stored.
The BKE_ptcache_mem_index_find is using unsigned ints for binary search
"high" values - but this leads to integer overflow if the totpoint
number is 0 and causes invalid array access.
| -rw-r--r-- | source/blender/blenkernel/intern/pointcache.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/source/blender/blenkernel/intern/pointcache.c b/source/blender/blenkernel/intern/pointcache.c index 9891a8cde28..d2ef59b238f 100644 --- a/source/blender/blenkernel/intern/pointcache.c +++ b/source/blender/blenkernel/intern/pointcache.c @@ -1769,7 +1769,7 @@ static void ptcache_file_pointers_init(PTCacheFile *pf) /* Check to see if point number "index" is in pm, uses binary search for index data. */ int BKE_ptcache_mem_index_find(PTCacheMem *pm, unsigned int index) { - if (pm->data[BPHYS_DATA_INDEX]) { + if (pm->totpoint > 0 && pm->data[BPHYS_DATA_INDEX]) { unsigned int *data = pm->data[BPHYS_DATA_INDEX]; unsigned int mid, low = 0, high = pm->totpoint - 1; |