Fix #23186: use of unitialized memory when creating new faces on a mesh

with a multires modifier.

1 files changed, 20 insertions, 9 deletions

diff --git a/source/blender/blenkernel/intern/customdata.c b/source/blender/blenkernel/intern/customdata.c
index 1f4b0f303f7..1f867a615b2 100644
--- a/source/blender/blenkernel/intern/customdata.c
+++ b/source/blender/blenkernel/intern/customdata.c
@@ -42,6 +42,7 @@
 
 #include "BLI_blenlib.h"
 #include "BLI_linklist.h"
+#include "BLI_math.h"
 #include "BLI_mempool.h"
 
 #include "BKE_customdata.h"
@@ -452,22 +453,27 @@ static void layerSwap_mdisps(void *data, const int *ci)
 	int corners, cornersize, S;
 
 	/* this function is untested .. */
-	corners = mdisp_corners(s);
-	cornersize = s->totdisp/corners;
+	if(s->disps) {
+		corners = mdisp_corners(s);
+		cornersize = s->totdisp/corners;
 
-	d = MEM_callocN(sizeof(float) * 3 * s->totdisp, "mdisps swap");
+		d = MEM_callocN(sizeof(float) * 3 * s->totdisp, "mdisps swap");
 
-	for(S = 0; S < corners; S++)
-		memcpy(d + cornersize*S, s->disps + cornersize*ci[S], cornersize*3*sizeof(float));
-	
-	if(s->disps)
-		MEM_freeN(s->disps);
-	s->disps = d;
+		for(S = 0; S < corners; S++)
+			memcpy(d + cornersize*S, s->disps + cornersize*ci[S], cornersize*3*sizeof(float));
+		
+		if(s->disps)
+			MEM_freeN(s->disps);
+		s->disps = d;
+	}
 }
 
 static void layerInterp_mdisps(void **sources, float *weights, float *sub_weights,
 				   int count, void *dest)
 {
+	MDisps *d = dest;
+	int i;
+
 	// XXX
 #if 0
 	MDisps *d = dest;
@@ -514,6 +520,11 @@ static void layerInterp_mdisps(void **sources, float *weights, float *sub_weight
 			copy_v3_v3(d->disps[y * st + x], srcdisp);
 		}
 	}
+#else
+	if(d->disps) {
+		for(i = 0; i < d->totdisp; ++i)
+			zero_v3(d->disps[i]);
+	}
 #endif
 }