diff options
author | Giovanni Remigi <gremigi> | 2020-03-11 19:11:23 +0300 |
---|---|---|
committer | Brecht Van Lommel <brecht@blender.org> | 2020-03-11 19:35:11 +0300 |
commit | 19b46b2fca790f00c7da79ecbcf219e772874a2c (patch) | |
tree | 136e4d924e86e6a9bce9de9e2e57ded261d81402 /intern | |
parent | 200695dd890caa5771043c2454a6731918023cad (diff) |
Fix Cycles crash in BVH8 build due to out of bounds memory access
Differential Revision: https://developer.blender.org/D7114
Diffstat (limited to 'intern')
-rw-r--r-- | intern/cycles/bvh/bvh.cpp | 10 |
1 files changed, 5 insertions, 5 deletions
diff --git a/intern/cycles/bvh/bvh.cpp b/intern/cycles/bvh/bvh.cpp index 3a8b0fe7fa2..e6502a40313 100644 --- a/intern/cycles/bvh/bvh.cpp +++ b/intern/cycles/bvh/bvh.cpp @@ -535,8 +535,9 @@ void BVH::pack_instances(size_t nodes_size, size_t leaf_nodes_size) /* Modify offsets into arrays */ int4 data = bvh_nodes[i + nsize_bbox]; - int4 data1 = bvh_nodes[i + nsize_bbox - 1]; + if (use_obvh) { + int4 data1 = bvh_nodes[i + nsize_bbox - 1]; data.z += (data.z < 0) ? -noffset_leaf : noffset; data.w += (data.w < 0) ? -noffset_leaf : noffset; data.x += (data.x < 0) ? -noffset_leaf : noffset; @@ -545,6 +546,8 @@ void BVH::pack_instances(size_t nodes_size, size_t leaf_nodes_size) data1.w += (data1.w < 0) ? -noffset_leaf : noffset; data1.x += (data1.x < 0) ? -noffset_leaf : noffset; data1.y += (data1.y < 0) ? -noffset_leaf : noffset; + pack_nodes[pack_nodes_offset + nsize_bbox] = data; + pack_nodes[pack_nodes_offset + nsize_bbox - 1] = data1; } else { data.z += (data.z < 0) ? -noffset_leaf : noffset; @@ -553,10 +556,7 @@ void BVH::pack_instances(size_t nodes_size, size_t leaf_nodes_size) data.x += (data.x < 0) ? -noffset_leaf : noffset; data.y += (data.y < 0) ? -noffset_leaf : noffset; } - } - pack_nodes[pack_nodes_offset + nsize_bbox] = data; - if (use_obvh) { - pack_nodes[pack_nodes_offset + nsize_bbox - 1] = data1; + pack_nodes[pack_nodes_offset + nsize_bbox] = data; } /* Usually this copies nothing, but we better |