Fix T37709: Memory corruption when freeing custom bone shape objects

Summary:
Issue was caused by access to pchan->custom object from channel free
function when freeing all objects from main. Order of objects free
is not defined and such an access might easily end up with access
to freed memory.

We don't need to do user counter stuff when freeing main, so added
an _ex functions with do_id_user flag which is used when freeing main.

We had the same issue with other datablocks, so now it should be
easier to support relevant user counter.

This issue was caused by the fix for T36391, so perhaps that's indeed
high time to do real user counter.

Reviewers: brecht, campbellbarton

Reviewed By: campbellbarton

Maniphest Tasks: T37709

Differential Revision: https://developer.blender.org/D137

1 files changed, 23 insertions, 6 deletions

diff --git a/source/blender/blenkernel/intern/action.c b/source/blender/blenkernel/intern/action.c
index c91fae2adbc..4991f1ce225 100644
--- a/source/blender/blenkernel/intern/action.c
+++ b/source/blender/blenkernel/intern/action.c
@@ -714,10 +714,12 @@ void BKE_pose_channels_hash_free(bPose *pose)
  * Deallocates a pose channel.
  * Does not free the pose channel itself.
  */
-void BKE_pose_channel_free(bPoseChannel *pchan)
+void BKE_pose_channel_free_ex(bPoseChannel *pchan, bool do_id_user)
 {
 	if (pchan->custom) {
-		id_us_min(&pchan->custom->id);
+		if (do_id_user) {
+			id_us_min(&pchan->custom->id);
+		}
 		pchan->custom = NULL;
 	}
 
@@ -734,17 +736,22 @@ void BKE_pose_channel_free(bPoseChannel *pchan)
 	}
 }
 
+void BKE_pose_channel_free(bPoseChannel *pchan)
+{
+	BKE_pose_channel_free_ex(pchan, true);
+}
+
 /**
  * Removes and deallocates all channels from a pose.
  * Does not free the pose itself.
  */
-void BKE_pose_channels_free(bPose *pose) 
+void BKE_pose_channels_free_ex(bPose *pose, bool do_id_user)
 {
 	bPoseChannel *pchan;
 	
 	if (pose->chanbase.first) {
 		for (pchan = pose->chanbase.first; pchan; pchan = pchan->next)
-			BKE_pose_channel_free(pchan);
+			BKE_pose_channel_free_ex(pchan, do_id_user);
 		
 		BLI_freelistN(&pose->chanbase);
 	}
@@ -752,14 +759,19 @@ void BKE_pose_channels_free(bPose *pose)
 	BKE_pose_channels_hash_free(pose);
 }
 
+void BKE_pose_channels_free(bPose *pose)
+{
+	BKE_pose_channels_free_ex(pose, true);
+}
+
 /**
  * Removes and deallocates all data from a pose, and also frees the pose.
  */
-void BKE_pose_free(bPose *pose)
+void BKE_pose_free_ex(bPose *pose, bool do_id_user)
 {
 	if (pose) {
 		/* free pose-channels */
-		BKE_pose_channels_free(pose);
+		BKE_pose_channels_free_ex(pose, do_id_user);
 		
 		/* free pose-groups */
 		if (pose->agroups.first)
@@ -777,6 +789,11 @@ void BKE_pose_free(bPose *pose)
 	}
 }
 
+void BKE_pose_free(bPose *pose)
+{
+	BKE_pose_free_ex(pose, true);
+}
+
 static void copy_pose_channel_data(bPoseChannel *pchan, const bPoseChannel *chan)
 {
 	bConstraint *pcon, *con;