another possible fix for bug [#29521], all callers of flip_side_name(...), assumed it initialized the string however for 1-2 length names it returned without doing anything.

in most cases the caller would then check if the name was different to see if the name was flipped, incorrectly comparing the uninitialized string with the original name.

4 files changed, 14 insertions, 9 deletions

diff --git a/source/blender/blenkernel/intern/deform.c b/source/blender/blenkernel/intern/deform.c
index 8dfd7e25bfb..e5176663228 100644
--- a/source/blender/blenkernel/intern/deform.c
+++ b/source/blender/blenkernel/intern/deform.c
@@ -410,11 +410,15 @@ void flip_side_name(char name[MAX_VGROUP_NAME], const char from_name[MAX_VGROUP_
 	char    number[MAX_VGROUP_NAME]=  "";   /* The number extension string */
 	char    *index=NULL;
 
-	len= BLI_strnlen(from_name, MAX_VGROUP_NAME);
-	if (len < 3) return; // we don't do names like .R or .L
-
+	/* always copy the name, since this can be called with an uninitialized string */
 	BLI_strncpy(name, from_name, MAX_VGROUP_NAME);
 
+	len= BLI_strnlen(from_name, MAX_VGROUP_NAME);
+	if (len < 3) {
+		/* we don't do names like .R or .L */
+		return;
+	}
+
 	/* We first check the case with a .### extension, let's find the last period */
 	if (isdigit(name[len-1])) {
 		index= strrchr(name, '.'); // last occurrence
diff --git a/source/blender/editors/armature/editarmature.c b/source/blender/editors/armature/editarmature.c
index caffdc29118..6dbb08e115f 100644
--- a/source/blender/editors/armature/editarmature.c
+++ b/source/blender/editors/armature/editarmature.c
@@ -161,7 +161,7 @@ void ED_armature_edit_bone_remove(bArmature *arm, EditBone *exBone)
 EditBone *ED_armature_bone_get_mirrored(ListBase *edbo, EditBone *ebo)
 {
 	EditBone *eboflip= NULL;
-	char name[32];
+	char name[MAXBONENAME];
 	
 	if (ebo == NULL)
 		return NULL;
@@ -4663,7 +4663,7 @@ static void add_verts_to_dgroups(ReportList *reports, Scene *scene, Object *ob,
 		
 		/* find flipped group */
 		if (dgroup && mirror) {
-			char name[32];
+			char name[MAXBONENAME];
 
 			// 0 = don't strip off number extensions
 			flip_side_name(name, dgroup->name, FALSE);
@@ -5456,7 +5456,7 @@ static int armature_flip_names_exec (bContext *C, wmOperator *UNUSED(op))
 {
 	Object *ob= CTX_data_edit_object(C);
 	bArmature *arm;
-	char newname[32];
+	char newname[MAXBONENAME];
 	
 	/* paranoia checks */
 	if (ELEM(NULL, ob, ob->pose)) 
diff --git a/source/blender/editors/armature/poseobject.c b/source/blender/editors/armature/poseobject.c
index 993c8420576..8d35122650f 100644
--- a/source/blender/editors/armature/poseobject.c
+++ b/source/blender/editors/armature/poseobject.c
@@ -989,7 +989,7 @@ static void set_pose_keys (Object *ob)
 static bPoseChannel *pose_bone_do_paste (Object *ob, bPoseChannel *chan, short selOnly, short flip)
 {
 	bPoseChannel *pchan;
-	char name[32];
+	char name[MAXBONENAME];
 	short paste_ok;
 	
 	/* get the name - if flipping, we must flip this first */
@@ -1740,7 +1740,7 @@ static int pose_flip_names_exec (bContext *C, wmOperator *UNUSED(op))
 	/* loop through selected bones, auto-naming them */
 	CTX_DATA_BEGIN(C, bPoseChannel*, pchan, selected_pose_bones)
 	{
-		char newname[32];
+		char newname[MAXBONENAME];
 		flip_side_name(newname, pchan->name, TRUE);
 		ED_armature_bone_rename(arm, pchan->name, newname);
 	}
diff --git a/source/blender/editors/object/object_select.c b/source/blender/editors/object/object_select.c
index fce37b7a022..c4d33b74574 100644
--- a/source/blender/editors/object/object_select.c
+++ b/source/blender/editors/object/object_select.c
@@ -41,6 +41,7 @@
 #include "DNA_modifier_types.h"
 #include "DNA_property_types.h"
 #include "DNA_scene_types.h"
+#include "DNA_armature_types.h"
 
 #include "BLI_math.h"
 #include "BLI_listbase.h"
@@ -893,7 +894,7 @@ static int object_select_mirror_exec(bContext *C, wmOperator *op)
 	extend= RNA_boolean_get(op->ptr, "extend");
 	
 	CTX_DATA_BEGIN(C, Base*, primbase, selected_bases) {
-		char tmpname[32];
+		char tmpname[MAXBONENAME];
 
 		flip_side_name(tmpname, primbase->object->id.name+2, TRUE);