diff options
| author | Campbell Barton <ideasman42@gmail.com> | 2011-03-08 06:14:59 +0300 |
|---|---|---|
| committer | Campbell Barton <ideasman42@gmail.com> | 2011-03-08 06:14:59 +0300 |
| commit | 97edca3bc9441eb5c99ed56e7d67b083931215b0 (patch) | |
| tree | 4e4ec64ab9ca2e7a20fe0822c570404533f1516d /source/blender/blenkernel/intern/idprop.c | |
| parent | b9db9e147efe08bee72451f386c3d8917998afdf (diff) | |
Old IDProperty bug, (from original commit r8916),
found crash while changing operator string size.
Shrinking arrays never worked right.
rather then "newlen * sizeof(...)", it would memcpy "newlen * oldlen * sizeof(...)" which always goes over the array bounds.
Diffstat (limited to 'source/blender/blenkernel/intern/idprop.c')
| -rw-r--r-- | source/blender/blenkernel/intern/idprop.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/source/blender/blenkernel/intern/idprop.c b/source/blender/blenkernel/intern/idprop.c index 40d12e06320..67be3e71101 100644 --- a/source/blender/blenkernel/intern/idprop.c +++ b/source/blender/blenkernel/intern/idprop.c @@ -240,7 +240,7 @@ void IDP_ResizeArray(IDProperty *prop, int newlen) else { /* newlen is smaller*/ idp_resize_group_array(prop, newlen, newarr); - memcpy(newarr, prop->data.pointer, newlen*prop->len*idp_size_table[(int)prop->subtype]); + memcpy(newarr, prop->data.pointer, newlen*idp_size_table[(int)prop->subtype]); } MEM_freeN(prop->data.pointer); |