diff options
author | Falk David <falkdavid@gmx.de> | 2021-06-23 07:56:36 +0300 |
---|---|---|
committer | Jeroen Bakker <jeroen@blender.org> | 2021-06-30 10:18:22 +0300 |
commit | 174f39bd039350737cb84fb21b4dd2264c381a21 (patch) | |
tree | 1f1f1cbaeeb1d830b6c7e4afa0703b50143c717d | |
parent | 27e32652679304eaa323c0819eb91fe296eeb275 (diff) |
Fix T89265: Crash when tabbing through num inputs
Fix by reverting the part of ec30cf0b742f5181c4de91b474ca01d6a809c593
that assigned `but->editval` in `ui_numedit_begin_set_values`.
Causing access freed memory when using tab to switch
to a numeric input and then leaving the textbox by clicking outside.
This was because `ui_numedit_begin_set_values` shouldn't need to set
`but->editval` and overwrite the pointer.
This would set a pointer that had previously been freed,
causing a `NULL` check to fail later on.
Ref D11679
-rw-r--r-- | source/blender/editors/interface/interface_handlers.c | 19 |
1 files changed, 11 insertions, 8 deletions
diff --git a/source/blender/editors/interface/interface_handlers.c b/source/blender/editors/interface/interface_handlers.c index a5a5a69728e..3f0a7074dfc 100644 --- a/source/blender/editors/interface/interface_handlers.c +++ b/source/blender/editors/interface/interface_handlers.c @@ -3890,6 +3890,13 @@ static void ui_do_but_textedit_select( /** \name Button Number Editing (various types) * \{ */ +static void ui_numedit_begin_set_values(uiBut *but, uiHandleButtonData *data) +{ + data->startvalue = ui_but_value_get(but); + data->origvalue = data->startvalue; + data->value = data->origvalue; +} + static void ui_numedit_begin(uiBut *but, uiHandleButtonData *data) { if (but->type == UI_BTYPE_CURVE) { @@ -3915,16 +3922,12 @@ static void ui_numedit_begin(uiBut *but, uiHandleButtonData *data) but->editvec = data->vec; } else { - float softrange, softmin, softmax; - - data->startvalue = ui_but_value_get(but); - data->origvalue = data->startvalue; - data->value = data->origvalue; + ui_numedit_begin_set_values(but, data); but->editval = &data->value; - softmin = but->softmin; - softmax = but->softmax; - softrange = softmax - softmin; + float softmin = but->softmin; + float softmax = but->softmax; + float softrange = softmax - softmin; if ((but->type == UI_BTYPE_NUM) && (ui_but_is_cursor_warp(but) == false)) { uiButNumber *number_but = (uiButNumber *)but; |