Fix buffer overflow vulnerabilities in mesh code.

Solves these security issues from T52924:
CVE-2017-12081
CVE-2017-12082
CVE-2017-12086
CVE-2017-12099
CVE-2017-12100
CVE-2017-12101
CVE-2017-12105

While the specific overflow issue may be fixed, loading the repro .blend
files may still crash because they are incomplete and corrupt. The way
they crash may be impossible to exploit, but this is difficult to prove.

Differential Revision: https://developer.blender.org/D3002

1 files changed, 15 insertions, 16 deletions

diff --git a/source/blender/blenkernel/intern/customdata.c b/source/blender/blenkernel/intern/customdata.c
index 68acb60f21a..cf86963cf60 100644
--- a/source/blender/blenkernel/intern/customdata.c
+++ b/source/blender/blenkernel/intern/customdata.c
@@ -157,7 +157,7 @@ static void layerCopy_mdeformvert(const void *source, void *dest,
 		MDeformVert *dvert = POINTER_OFFSET(dest, i * size);
 
 		if (dvert->totweight) {
-			MDeformWeight *dw = MEM_mallocN(dvert->totweight * sizeof(*dw),
+			MDeformWeight *dw = MEM_malloc_arrayN(dvert->totweight, sizeof(*dw),
 			                                "layerCopy_mdeformvert dw");
 
 			memcpy(dw, dvert->dw, dvert->totweight * sizeof(*dw));
@@ -281,7 +281,7 @@ static void layerInterp_mdeformvert(
 		}
 
 		if (totweight) {
-			dvert->dw = MEM_mallocN(sizeof(*dvert->dw) * totweight, __func__);
+			dvert->dw = MEM_malloc_arrayN(totweight, sizeof(*dvert->dw), __func__);
 		}
 	}
 
@@ -536,11 +536,11 @@ static void layerSwap_mdisps(void *data, const int *ci)
 
 			MEM_freeN(s->disps);
 			s->totdisp = (s->totdisp / corners) * nverts;
-			s->disps = MEM_callocN(s->totdisp * sizeof(float) * 3, "mdisp swap");
+			s->disps = MEM_calloc_arrayN(s->totdisp, sizeof(float) * 3, "mdisp swap");
 			return;
 		}
 
-		d = MEM_callocN(sizeof(float) * 3 * s->totdisp, "mdisps swap");
+		d = MEM_calloc_arrayN(s->totdisp, 3 * sizeof(float), "mdisps swap");
 
 		for (S = 0; S < corners; S++)
 			memcpy(d + cornersize * S, s->disps + cornersize * ci[S], cornersize * 3 * sizeof(float));
@@ -596,7 +596,7 @@ static int layerRead_mdisps(CDataFile *cdf, void *data, int count)
 
 	for (i = 0; i < count; ++i) {
 		if (!d[i].disps)
-			d[i].disps = MEM_callocN(sizeof(float) * 3 * d[i].totdisp, "mdisps read");
+			d[i].disps = MEM_calloc_arrayN(d[i].totdisp, 3 * sizeof(float), "mdisps read");
 
 		if (!cdf_read_data(cdf, d[i].totdisp * 3 * sizeof(float), d[i].disps)) {
 			printf("failed to read multires displacement %d/%d %d\n", i, count, d[i].totdisp);
@@ -1806,7 +1806,7 @@ void CustomData_set_layer_flag(struct CustomData *data, int type, int flag)
 
 static int customData_resize(CustomData *data, int amount)
 {
-	CustomDataLayer *tmp = MEM_callocN(sizeof(*tmp) * (data->maxlayer + amount),
+	CustomDataLayer *tmp = MEM_calloc_arrayN((data->maxlayer + amount), sizeof(*tmp),
 	                                   "CustomData->layers");
 	if (!tmp) return 0;
 
@@ -1824,7 +1824,6 @@ static CustomDataLayer *customData_add_layer__internal(CustomData *data, int typ
                                                        int totelem, const char *name)
 {
 	const LayerTypeInfo *typeInfo = layerType_getInfo(type);
-	const size_t size = (size_t)totelem * typeInfo->size;
 	int flag = 0, index = data->totlayer;
 	void *newlayerdata = NULL;
 
@@ -1841,12 +1840,12 @@ static CustomDataLayer *customData_add_layer__internal(CustomData *data, int typ
 	if ((alloctype == CD_ASSIGN) || (alloctype == CD_REFERENCE)) {
 		newlayerdata = layerdata;
 	}
-	else if (size > 0) {
+	else if (totelem > 0 && typeInfo->size > 0) {
 		if (alloctype == CD_DUPLICATE && layerdata) {
-			newlayerdata = MEM_mallocN(size, layerType_getName(type));
+			newlayerdata = MEM_malloc_arrayN((size_t)totelem, typeInfo->size, layerType_getName(type));
 		}
 		else {
-			newlayerdata = MEM_callocN(size, layerType_getName(type));
+			newlayerdata = MEM_calloc_arrayN((size_t)totelem, typeInfo->size, layerType_getName(type));
 		}
 
 		if (!newlayerdata)
@@ -1857,7 +1856,7 @@ static CustomDataLayer *customData_add_layer__internal(CustomData *data, int typ
 		if (typeInfo->copy)
 			typeInfo->copy(layerdata, newlayerdata, totelem);
 		else
-			memcpy(newlayerdata, layerdata, size);
+			memcpy(newlayerdata, layerdata, (size_t)totelem * typeInfo->size);
 	}
 	else if (alloctype == CD_DEFAULT) {
 		if (typeInfo->set_default)
@@ -2048,7 +2047,7 @@ static void *customData_duplicate_referenced_layer_index(CustomData *data, const
 		const LayerTypeInfo *typeInfo = layerType_getInfo(layer->type);
 
 		if (typeInfo->copy) {
-			void *dst_data = MEM_mallocN((size_t)totelem * typeInfo->size, "CD duplicate ref layer");
+			void *dst_data = MEM_malloc_arrayN((size_t)totelem, typeInfo->size, "CD duplicate ref layer");
 			typeInfo->copy(layer->data, dst_data, totelem);
 			layer->data = dst_data;
 		}
@@ -2277,7 +2276,7 @@ void CustomData_interp(const CustomData *source, CustomData *dest,
 	 * elements
 	 */
 	if (count > SOURCE_BUF_SIZE)
-		sources = MEM_mallocN(sizeof(*sources) * count, __func__);
+		sources = MEM_malloc_arrayN(count, sizeof(*sources), __func__);
 
 	/* interpolates a layer at a time */
 	dest_i = 0;
@@ -3144,7 +3143,7 @@ void CustomData_bmesh_interp(
 	 * elements
 	 */
 	if (count > SOURCE_BUF_SIZE)
-		sources = MEM_mallocN(sizeof(*sources) * count, __func__);
+		sources = MEM_malloc_arrayN(count, sizeof(*sources), __func__);
 
 	/* interpolates a layer at a time */
 	for (i = 0; i < data->totlayer; ++i) {
@@ -3334,7 +3333,7 @@ void CustomData_file_write_prepare(
 		else {
 			if (UNLIKELY((size_t)j >= write_layers_size)) {
 				if (write_layers == write_layers_buff) {
-					write_layers = MEM_mallocN(sizeof(*write_layers) * (write_layers_size + chunk_size), __func__);
+					write_layers = MEM_malloc_arrayN((write_layers_size + chunk_size), sizeof(*write_layers), __func__);
 					if (write_layers_buff) {
 						memcpy(write_layers, write_layers_buff, sizeof(*write_layers) * write_layers_size);
 					}
@@ -4002,7 +4001,7 @@ void CustomData_data_transfer(const MeshPairRemap *me_remap, const CustomDataTra
 	}
 
 	if (data_src) {
-		tmp_data_src = MEM_mallocN(sizeof(*tmp_data_src) * tmp_buff_size, __func__);
+		tmp_data_src = MEM_malloc_arrayN(tmp_buff_size, sizeof(*tmp_data_src), __func__);
 	}
 
 	if (data_type & CD_FAKE) {