fix [#29044] applying mirror modifier causes crash; something with vertex groups?

1 files changed, 19 insertions, 15 deletions

diff --git a/source/blender/blenkernel/intern/deform.c b/source/blender/blenkernel/intern/deform.c
index 0f6828cc358..b8f5d79ea0d 100644
--- a/source/blender/blenkernel/intern/deform.c
+++ b/source/blender/blenkernel/intern/deform.c
@@ -114,18 +114,20 @@ void defvert_sync (MDeformVert *dvert_r, const MDeformVert *dvert, int use_verif
 }
 
 /* be sure all flip_map values are valid */
-void defvert_sync_mapped (MDeformVert *dvert_r, const MDeformVert *dvert, const int *flip_map, int use_verify)
+void defvert_sync_mapped (MDeformVert *dvert_r, const MDeformVert *dvert, const int *flip_map, const int flip_map_len, const int use_verify)
 {
-	if(dvert->totweight && dvert_r->totweight) {
+	if (dvert->totweight && dvert_r->totweight) {
 		int i;
 		MDeformWeight *dw;
-		for(i=0, dw=dvert->dw; i < dvert->totweight; i++, dw++) {
-			MDeformWeight *dw_r;
-			if(use_verify)	dw_r= defvert_find_index(dvert_r, flip_map[dw->def_nr]);
-			else			dw_r= defvert_verify_index(dvert_r, flip_map[dw->def_nr]);
-
-			if(dw_r) {
-				dw_r->weight= dw->weight;
+		for (i=0, dw=dvert->dw; i < dvert->totweight; i++, dw++) {
+			if (dw->def_nr < flip_map_len) {
+				MDeformWeight *dw_r;
+				if(use_verify)	dw_r= defvert_find_index(dvert_r, flip_map[dw->def_nr]);
+				else			dw_r= defvert_verify_index(dvert_r, flip_map[dw->def_nr]);
+
+				if(dw_r) {
+					dw_r->weight= dw->weight;
+				}
 			}
 		}
 	}
@@ -163,14 +165,16 @@ void defvert_normalize (MDeformVert *dvert)
 	}
 }
 
-void defvert_flip (MDeformVert *dvert, const int *flip_map)
+void defvert_flip (MDeformVert *dvert, const int *flip_map, const int flip_map_len)
 {
 	MDeformWeight *dw;
 	int i;
 
-	for(dw= dvert->dw, i=0; i<dvert->totweight; dw++, i++)
-		if(flip_map[dw->def_nr] >= 0)
+	for(dw= dvert->dw, i=0; i<dvert->totweight; dw++, i++) {
+		if((dw->def_nr < flip_map_len) && (flip_map[dw->def_nr] >= 0)) {
 			dw->def_nr= flip_map[dw->def_nr];
+		}
+	}
 }
 
 
@@ -250,17 +254,17 @@ int defgroup_find_index (Object *ob, bDeformGroup *dg)
 }
 
 /* note, must be freed */
-int *defgroup_flip_map(Object *ob, int use_default)
+int *defgroup_flip_map(Object *ob, int *flip_map_len, int use_default)
 {
 	bDeformGroup *dg;
-	int totdg= BLI_countlist(&ob->defbase);
+	int totdg= *flip_map_len= BLI_countlist(&ob->defbase);
 
 	if(totdg==0) {
 		return NULL;
 	}
 	else {
 		char name[sizeof(dg->name)];
-		int i, flip_num, *map= MEM_mallocN(totdg * sizeof(int), "get_defgroup_flip_map");
+		int i, flip_num, *map= MEM_mallocN(totdg * sizeof(int), __func__);
 
 		memset(map, -1, totdg * sizeof(int));