another possible fix for bug [#29521], all callers of flip_side_name(...), assumed it initialized the string however for 1-2 length names it returned without doing anything.

in most cases the caller would then check if the name was different to see if the name was flipped, incorrectly comparing the uninitialized string with the original name.

1 files changed, 7 insertions, 3 deletions

diff --git a/source/blender/blenkernel/intern/deform.c b/source/blender/blenkernel/intern/deform.c
index 8dfd7e25bfb..e5176663228 100644
--- a/source/blender/blenkernel/intern/deform.c
+++ b/source/blender/blenkernel/intern/deform.c
@@ -410,11 +410,15 @@ void flip_side_name(char name[MAX_VGROUP_NAME], const char from_name[MAX_VGROUP_
 	char    number[MAX_VGROUP_NAME]=  "";   /* The number extension string */
 	char    *index=NULL;
 
-	len= BLI_strnlen(from_name, MAX_VGROUP_NAME);
-	if (len < 3) return; // we don't do names like .R or .L
-
+	/* always copy the name, since this can be called with an uninitialized string */
 	BLI_strncpy(name, from_name, MAX_VGROUP_NAME);
 
+	len= BLI_strnlen(from_name, MAX_VGROUP_NAME);
+	if (len < 3) {
+		/* we don't do names like .R or .L */
+		return;
+	}
+
 	/* We first check the case with a .### extension, let's find the last period */
 	if (isdigit(name[len-1])) {
 		index= strrchr(name, '.'); // last occurrence