diff options
| author | Fen <chemicalcrux> | 2021-06-18 04:13:09 +0300 |
|---|---|---|
| committer | Jeroen Bakker <jeroen@blender.org> | 2021-06-30 09:21:58 +0300 |
| commit | 8dd18a77e72444c5a9cc60c1043fa96b28260d9a (patch) | |
| tree | d1017f97a57ada054b45f3f83c2dc4f55926bba4 | |
| parent | f6fb695ed8b08d28f4d0f1a71c1b60cf15929393 (diff) | |
Fix T89247: Dereference arguments to comparison function correctly
`bm_face_len_cmp` incorrectly interpreted its arguments as `BMFace *`
instead of `BMFace **`, causing an out-of-bounds read.
Ref D11637
| -rw-r--r-- | source/blender/bmesh/tools/bmesh_region_match.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/source/blender/bmesh/tools/bmesh_region_match.c b/source/blender/bmesh/tools/bmesh_region_match.c index 44761b9f37e..67219dbd8cb 100644 --- a/source/blender/bmesh/tools/bmesh_region_match.c +++ b/source/blender/bmesh/tools/bmesh_region_match.c @@ -561,7 +561,8 @@ static void bm_uuidwalk_pass_add(UUIDWalk *uuidwalk, static int bm_face_len_cmp(const void *v1, const void *v2) { - const BMFace *f1 = v1, *f2 = v2; + const BMFace *f1 = *((BMFace **)v1); + const BMFace *f2 = *((BMFace **)v2); if (f1->len > f2->len) { return 1; |