diff options
author | Antony Riakiotakis <kalast@gmail.com> | 2015-07-24 13:24:05 +0300 |
---|---|---|
committer | Antony Riakiotakis <kalast@gmail.com> | 2015-07-24 13:24:57 +0300 |
commit | 2dce6dccbb64061bc5df56b417da45047aa1e8dc (patch) | |
tree | 0b1c433c0a7e2dfa788360ec6aaf7e1b0e5d2469 /source/blender/blenkernel/intern/cdderivedmesh.c | |
parent | 95f698f84082ef9e31cd3de08f799de3ba791ed8 (diff) |
Fix out of bounds memory access when copying loose vertices in cddm
Caused by own fix for too much allocated memory not taking all code
into account.
Diffstat (limited to 'source/blender/blenkernel/intern/cdderivedmesh.c')
-rw-r--r-- | source/blender/blenkernel/intern/cdderivedmesh.c | 16 |
1 files changed, 8 insertions, 8 deletions
diff --git a/source/blender/blenkernel/intern/cdderivedmesh.c b/source/blender/blenkernel/intern/cdderivedmesh.c index 9a41c7397ae..ee73f5d2210 100644 --- a/source/blender/blenkernel/intern/cdderivedmesh.c +++ b/source/blender/blenkernel/intern/cdderivedmesh.c @@ -639,7 +639,7 @@ static void cdDM_drawMappedFaces( int i, j; int start_element = 0, tot_element, tot_drawn; int totpoly; - int tottri; + int tot_tri_elem; int mat_index; GPUBuffer *findex_buffer = NULL; @@ -705,14 +705,14 @@ static void cdDM_drawMappedFaces( glShadeModel(GL_SMOOTH); - tottri = dm->drawObject->tot_triangle_point; + tot_tri_elem = dm->drawObject->tot_triangle_point; - if (tottri == 0) { + if (tot_tri_elem == 0) { /* avoid buffer problems in following code */ } else if (setDrawOptions == NULL) { /* just draw the entire face array */ - GPU_buffer_draw_elements(dm->drawObject->triangles, GL_TRIANGLES, 0, tottri); + GPU_buffer_draw_elements(dm->drawObject->triangles, GL_TRIANGLES, 0, tot_tri_elem); } else { for (mat_index = 0; mat_index < dm->drawObject->totmaterial; mat_index++) { @@ -1281,9 +1281,9 @@ static void cdDM_buffer_copy_vertex( } /* copy loose points */ - j = dm->drawObject->tot_triangle_point * 3; + j = dm->drawObject->tot_loop_verts; for (i = 0; i < dm->drawObject->totvert; i++) { - if (dm->drawObject->vert_points[i].point_index >= dm->drawObject->tot_triangle_point) { + if (dm->drawObject->vert_points[i].point_index >= dm->drawObject->tot_loop_verts) { copy_v3_v3(&varray[j], mvert[i].co); j += 3; } @@ -1607,7 +1607,7 @@ static void cdDM_drawobject_init_vert_points( gdo->vert_points = MEM_mallocN(sizeof(GPUVertPointLink) * gdo->totvert, "GPUDrawObject.vert_points"); #ifdef USE_GPU_POINT_LINK - gdo->vert_points_mem = MEM_callocN(sizeof(GPUVertPointLink) * gdo->tot_triangle_point, + gdo->vert_points_mem = MEM_callocN(sizeof(GPUVertPointLink) * gdo->totvert, "GPUDrawObject.vert_points_mem"); gdo->vert_points_usage = 0; #endif @@ -1644,7 +1644,7 @@ static void cdDM_drawobject_init_vert_points( /* map any unused vertices to loose points */ for (i = 0; i < gdo->totvert; i++) { if (gdo->vert_points[i].point_index == -1) { - gdo->vert_points[i].point_index = gdo->tot_triangle_point + gdo->tot_loose_point; + gdo->vert_points[i].point_index = gdo->tot_loop_verts + gdo->tot_loose_point; gdo->tot_loose_point++; } } |