LibOverride: Fix use-after-free error when freeing whole Main DB.

We do not want to touch to other ID pointers in that case, those might
have already been freed...

2 files changed, 10 insertions, 8 deletions

diff --git a/source/blender/blenkernel/intern/library_override.c b/source/blender/blenkernel/intern/library_override.c
index ce368575492..ba482359607 100644
--- a/source/blender/blenkernel/intern/library_override.c
+++ b/source/blender/blenkernel/intern/library_override.c
@@ -111,11 +111,11 @@ void BKE_override_library_copy(ID *dst_id, const ID *src_id)
 
   if (dst_id->override_library != NULL) {
     if (src_id->override_library == NULL) {
-      BKE_override_library_free(&dst_id->override_library);
+      BKE_override_library_free(&dst_id->override_library, true);
       return;
     }
     else {
-      BKE_override_library_clear(dst_id->override_library);
+      BKE_override_library_clear(dst_id->override_library, true);
     }
   }
   else if (src_id->override_library == NULL) {
@@ -144,7 +144,7 @@ void BKE_override_library_copy(ID *dst_id, const ID *src_id)
 }
 
 /** Clear any overriding data from given \a override. */
-void BKE_override_library_clear(IDOverrideLibrary *override)
+void BKE_override_library_clear(IDOverrideLibrary *override, const bool do_id_user)
 {
   BLI_assert(override != NULL);
 
@@ -153,16 +153,18 @@ void BKE_override_library_clear(IDOverrideLibrary *override)
   }
   BLI_freelistN(&override->properties);
 
-  id_us_min(override->reference);
-  /* override->storage should never be refcounted... */
+  if (do_id_user) {
+    id_us_min(override->reference);
+    /* override->storage should never be refcounted... */
+  }
 }
 
 /** Free given \a override. */
-void BKE_override_library_free(struct IDOverrideLibrary **override)
+void BKE_override_library_free(struct IDOverrideLibrary **override, const bool do_id_user)
 {
   BLI_assert(*override != NULL);
 
-  BKE_override_library_clear(*override);
+  BKE_override_library_clear(*override, do_id_user);
   MEM_freeN(*override);
   *override = NULL;
 }
diff --git a/source/blender/blenkernel/intern/library_remap.c b/source/blender/blenkernel/intern/library_remap.c
index 8fe2552c03f..04ea540fac9 100644
--- a/source/blender/blenkernel/intern/library_remap.c
+++ b/source/blender/blenkernel/intern/library_remap.c
@@ -757,7 +757,7 @@ void BKE_libblock_free_data(ID *id, const bool do_id_user)
   }
 
   if (id->override_library) {
-    BKE_override_library_free(&id->override_library);
+    BKE_override_library_free(&id->override_library, do_id_user);
   }
 
   /* XXX TODO remove animdata handling from each type's freeing func,