2.5

Text Object: editmode suffered wrong allocation and reading from wrong
memory, causing crashes when typing more than a few chars.

2 files changed, 3 insertions, 3 deletions

diff --git a/source/blender/blenkernel/intern/curve.c b/source/blender/blenkernel/intern/curve.c
index fab9669d55f..7dd868278f4 100644
--- a/source/blender/blenkernel/intern/curve.c
+++ b/source/blender/blenkernel/intern/curve.c
@@ -155,7 +155,7 @@ Curve *add_curve(char *name, int type)
 		cu->str= MEM_mallocN(12, "str");
 		strcpy(cu->str, "Text");
 		cu->pos= 4;
-		cu->strinfo= MEM_callocN(12*sizeof(CharInfo), "strinfo");
+		cu->strinfo= MEM_callocN(12*sizeof(CharInfo), "strinfo new");
 		cu->totbox= cu->actbox= 1;
 		cu->tb= MEM_callocN(MAXTEXTBOX*sizeof(TextBox), "textbox");
 		cu->tb[0].w = cu->tb[0].h = 0.0;
diff --git a/source/blender/blenkernel/intern/font.c b/source/blender/blenkernel/intern/font.c
index c3cf6e06c09..60a7ffc28d9 100644
--- a/source/blender/blenkernel/intern/font.c
+++ b/source/blender/blenkernel/intern/font.c
@@ -682,7 +682,7 @@ struct chartrans *BKE_text_to_curve(Scene *scene, Object *ob, int mode)
 		cu->ulheight = 0.05;
 	
 	if (cu->strinfo==NULL)	/* old file */
-		cu->strinfo = MEM_callocN((slen+1) * sizeof(CharInfo), "strinfo compat");
+		cu->strinfo = MEM_callocN((slen+4) * sizeof(CharInfo), "strinfo compat");
 	
 	custrinfo= cu->strinfo;
 	if (cu->editfont)
@@ -1145,7 +1145,7 @@ struct chartrans *BKE_text_to_curve(Scene *scene, Object *ob, int mode)
 		if (cu->sepchar==0) {
 			for (i= 0; i<slen; i++) {
 				cha = (uintptr_t) mem[i];
-				info = &(cu->strinfo[i]);
+				info = &(custrinfo[i]);
 				if (info->mat_nr > (ob->totcol)) {
 					/* printf("Error: Illegal material index (%d) in text object, setting to 0\n", info->mat_nr); */
 					info->mat_nr = 0;