Welcome to mirror list, hosted at ThFree Co, Russian Federation.

git.blender.org/blender.git - Unnamed repository; edit this file 'description' to name the repository.
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorGiovanni Remigi <gremigi>2020-03-11 19:11:23 +0300
committerBrecht Van Lommel <brecht@blender.org>2020-03-11 19:35:11 +0300
commit19b46b2fca790f00c7da79ecbcf219e772874a2c (patch)
tree136e4d924e86e6a9bce9de9e2e57ded261d81402 /intern/cycles/bvh
parent200695dd890caa5771043c2454a6731918023cad (diff)
Fix Cycles crash in BVH8 build due to out of bounds memory access
Differential Revision: https://developer.blender.org/D7114
Diffstat (limited to 'intern/cycles/bvh')
-rw-r--r--intern/cycles/bvh/bvh.cpp10
1 files changed, 5 insertions, 5 deletions
diff --git a/intern/cycles/bvh/bvh.cpp b/intern/cycles/bvh/bvh.cpp
index 3a8b0fe7fa2..e6502a40313 100644
--- a/intern/cycles/bvh/bvh.cpp
+++ b/intern/cycles/bvh/bvh.cpp
@@ -535,8 +535,9 @@ void BVH::pack_instances(size_t nodes_size, size_t leaf_nodes_size)
/* Modify offsets into arrays */
int4 data = bvh_nodes[i + nsize_bbox];
- int4 data1 = bvh_nodes[i + nsize_bbox - 1];
+
if (use_obvh) {
+ int4 data1 = bvh_nodes[i + nsize_bbox - 1];
data.z += (data.z < 0) ? -noffset_leaf : noffset;
data.w += (data.w < 0) ? -noffset_leaf : noffset;
data.x += (data.x < 0) ? -noffset_leaf : noffset;
@@ -545,6 +546,8 @@ void BVH::pack_instances(size_t nodes_size, size_t leaf_nodes_size)
data1.w += (data1.w < 0) ? -noffset_leaf : noffset;
data1.x += (data1.x < 0) ? -noffset_leaf : noffset;
data1.y += (data1.y < 0) ? -noffset_leaf : noffset;
+ pack_nodes[pack_nodes_offset + nsize_bbox] = data;
+ pack_nodes[pack_nodes_offset + nsize_bbox - 1] = data1;
}
else {
data.z += (data.z < 0) ? -noffset_leaf : noffset;
@@ -553,10 +556,7 @@ void BVH::pack_instances(size_t nodes_size, size_t leaf_nodes_size)
data.x += (data.x < 0) ? -noffset_leaf : noffset;
data.y += (data.y < 0) ? -noffset_leaf : noffset;
}
- }
- pack_nodes[pack_nodes_offset + nsize_bbox] = data;
- if (use_obvh) {
- pack_nodes[pack_nodes_offset + nsize_bbox - 1] = data1;
+ pack_nodes[pack_nodes_offset + nsize_bbox] = data;
}
/* Usually this copies nothing, but we better