went over all uses of MDeformWeight.def_nr and made sure the value is clamped when used as an array index.

4 files changed, 37 insertions, 31 deletions

diff --git a/source/blender/blenkernel/BKE_deform.h b/source/blender/blenkernel/BKE_deform.h
index b08afd9c475..9902b26e15b 100644
--- a/source/blender/blenkernel/BKE_deform.h
+++ b/source/blender/blenkernel/BKE_deform.h
@@ -63,7 +63,7 @@ void defvert_copy_index(struct MDeformVert *dvert_dst, const struct MDeformVert
 void defvert_sync(struct MDeformVert *dvert_dst, const struct MDeformVert *dvert_src, int use_verify);
 void defvert_sync_mapped(struct MDeformVert *dvert_dst, const struct MDeformVert *dvert_src,
                          const int *flip_map, const int flip_map_len, const int use_verify);
-void defvert_remap (struct MDeformVert *dvert, int *map);
+void defvert_remap (struct MDeformVert *dvert, int *map, const int map_len);
 void defvert_flip(struct MDeformVert *dvert, const int *flip_map, const int flip_map_len);
 void defvert_normalize(struct MDeformVert *dvert);
 
diff --git a/source/blender/blenkernel/intern/DerivedMesh.c b/source/blender/blenkernel/intern/DerivedMesh.c
index 1498a3b4cc0..4b91911a6ab 100644
--- a/source/blender/blenkernel/intern/DerivedMesh.c
+++ b/source/blender/blenkernel/intern/DerivedMesh.c
@@ -642,7 +642,7 @@ enum {
 };
 
 static void calc_weightpaint_vert_color(
-        Object *ob, ColorBand *coba, int vert, unsigned char *col,
+        Object *ob, const int defbase_tot, ColorBand *coba, int vert, unsigned char *col,
         const char *dg_flags, int selected, int UNUSED(unselected), const int draw_flag)
 {
 	Mesh *me = ob->data;
@@ -661,10 +661,12 @@ static void calc_weightpaint_vert_color(
 			for (i = dvert->totweight; i > 0; i--, dw++) {
 				/* in multipaint, get the average if auto normalize is inactive
 				 * get the sum if it is active */
-				if (dg_flags[dw->def_nr]) {
-					if (dw->weight) {
-						input += dw->weight;
-						was_a_nonzero= TRUE;
+				if (dw->def_nr < defbase_tot) {
+					if (dg_flags[dw->def_nr]) {
+						if (dw->weight) {
+							input += dw->weight;
+							was_a_nonzero= TRUE;
+						}
 					}
 				}
 			}
@@ -718,20 +720,20 @@ static void add_weight_mcol_dm(Object *ob, DerivedMesh *dm, int const draw_flag)
 	unsigned char *wtcol;
 	int i;
 	
-	int defbase_len = BLI_countlist(&ob->defbase);
-	char *defbase_sel = MEM_mallocN(defbase_len * sizeof(char), __func__);
-	int selected = get_selected_defgroups(ob, defbase_sel, defbase_len);
-	int unselected = defbase_len - selected;
+	int defbase_tot = BLI_countlist(&ob->defbase);
+	char *defbase_sel = MEM_mallocN(defbase_tot * sizeof(char), __func__);
+	int selected = get_selected_defgroups(ob, defbase_sel, defbase_tot);
+	int unselected = defbase_tot - selected;
 
 	wtcol = MEM_callocN (sizeof (unsigned char) * me->totface*4*4, "weightmap");
 	
 	memset(wtcol, 0x55, sizeof (unsigned char) * me->totface*4*4);
 	for (i=0; i<me->totface; i++, mf++) {
-		calc_weightpaint_vert_color(ob, coba, mf->v1, &wtcol[(i*4 + 0)*4], defbase_sel, selected, unselected, draw_flag);
-		calc_weightpaint_vert_color(ob, coba, mf->v2, &wtcol[(i*4 + 1)*4], defbase_sel, selected, unselected, draw_flag);
-		calc_weightpaint_vert_color(ob, coba, mf->v3, &wtcol[(i*4 + 2)*4], defbase_sel, selected, unselected, draw_flag);
+		calc_weightpaint_vert_color(ob, defbase_tot, coba, mf->v1, &wtcol[(i*4 + 0)*4], defbase_sel, selected, unselected, draw_flag);
+		calc_weightpaint_vert_color(ob, defbase_tot, coba, mf->v2, &wtcol[(i*4 + 1)*4], defbase_sel, selected, unselected, draw_flag);
+		calc_weightpaint_vert_color(ob, defbase_tot, coba, mf->v3, &wtcol[(i*4 + 2)*4], defbase_sel, selected, unselected, draw_flag);
 		if (mf->v4)
-			calc_weightpaint_vert_color(ob, coba, mf->v4, &wtcol[(i*4 + 3)*4], defbase_sel, selected, unselected, draw_flag);
+			calc_weightpaint_vert_color(ob, defbase_tot, coba, mf->v4, &wtcol[(i*4 + 3)*4], defbase_sel, selected, unselected, draw_flag);
 	}
 	
 	MEM_freeN(defbase_sel);
diff --git a/source/blender/blenkernel/intern/armature.c b/source/blender/blenkernel/intern/armature.c
index e7743bea2cd..e10c4b24458 100644
--- a/source/blender/blenkernel/intern/armature.c
+++ b/source/blender/blenkernel/intern/armature.c
@@ -827,7 +827,7 @@ void armature_deform_verts(Object *armOb, Object *target, DerivedMesh *dm,
 	const short use_envelope = deformflag & ARM_DEF_ENVELOPE;
 	const short use_quaternion = deformflag & ARM_DEF_QUATERNION;
 	const short invert_vgroup= deformflag & ARM_DEF_INVERT_VGROUP;
-	int numGroups = 0;		/* safety for vertexgroup index overflow */
+	int defbase_tot = 0;		/* safety for vertexgroup index overflow */
 	int i, target_totvert = 0;	/* safety for vertexgroup overflow */
 	int use_dverts = 0;
 	int armature_def_nr;
@@ -869,7 +869,7 @@ void armature_deform_verts(Object *armOb, Object *target, DerivedMesh *dm,
 	armature_def_nr= defgroup_name_index(target, defgrp_name);
 	
 	if(ELEM(target->type, OB_MESH, OB_LATTICE)) {
-		numGroups = BLI_countlist(&target->defbase);
+		defbase_tot = BLI_countlist(&target->defbase);
 		
 		if(target->type==OB_MESH) {
 			Mesh *me= target->data;
@@ -896,8 +896,8 @@ void armature_deform_verts(Object *armOb, Object *target, DerivedMesh *dm,
 			else if(dverts) use_dverts = 1;
 
 			if(use_dverts) {
-				defnrToPC = MEM_callocN(sizeof(*defnrToPC) * numGroups, "defnrToBone");
-				defnrToPCIndex = MEM_callocN(sizeof(*defnrToPCIndex) * numGroups, "defnrToIndex");
+				defnrToPC = MEM_callocN(sizeof(*defnrToPC) * defbase_tot, "defnrToBone");
+				defnrToPCIndex = MEM_callocN(sizeof(*defnrToPCIndex) * defbase_tot, "defnrToIndex");
 				for(i = 0, dg = target->defbase.first; dg;
 					i++, dg = dg->next) {
 					defnrToPC[i] = get_pose_channel(armOb->pose, dg->name);
@@ -975,7 +975,7 @@ void armature_deform_verts(Object *armOb, Object *target, DerivedMesh *dm,
 			
 			for(j = 0; j < dvert->totweight; j++){
 				int index = dvert->dw[j].def_nr;
-				if(index < numGroups && (pchan= defnrToPC[index])) {
+				if(index < defbase_tot && (pchan= defnrToPC[index])) {
 					float weight = dvert->dw[j].weight;
 					Bone *bone= pchan->bone;
 					pdef_info= pdef_info_array + defnrToPCIndex[index];
diff --git a/source/blender/blenkernel/intern/deform.c b/source/blender/blenkernel/intern/deform.c
index e5176663228..94be15e27c0 100644
--- a/source/blender/blenkernel/intern/deform.c
+++ b/source/blender/blenkernel/intern/deform.c
@@ -161,12 +161,14 @@ void defvert_sync_mapped(MDeformVert *dvert_dst, const MDeformVert *dvert_src,
 }
 
 /* be sure all flip_map values are valid */
-void defvert_remap(MDeformVert *dvert, int *map)
+void defvert_remap(MDeformVert *dvert, int *map, const int map_len)
 {
 	MDeformWeight *dw;
 	int i;
 	for (i=0, dw=dvert->dw; i<dvert->totweight; i++, dw++) {
-		dw->def_nr= map[dw->def_nr];
+		if (dw->def_nr < map_len) {
+			dw->def_nr= map[dw->def_nr];
+		}
 	}
 }
 
@@ -198,8 +200,10 @@ void defvert_flip(MDeformVert *dvert, const int *flip_map, const int flip_map_le
 	int i;
 
 	for (dw= dvert->dw, i=0; i<dvert->totweight; dw++, i++) {
-		if ((dw->def_nr < flip_map_len) && (flip_map[dw->def_nr] >= 0)) {
-			dw->def_nr= flip_map[dw->def_nr];
+		if (dw->def_nr < flip_map_len) {
+			if (flip_map[dw->def_nr] >= 0) {
+				dw->def_nr= flip_map[dw->def_nr];
+			}
 		}
 	}
 }
@@ -283,17 +287,17 @@ int defgroup_find_index(Object *ob, bDeformGroup *dg)
 /* note, must be freed */
 int *defgroup_flip_map(Object *ob, int *flip_map_len, int use_default)
 {
-	int totdg= *flip_map_len= BLI_countlist(&ob->defbase);
+	int defbase_tot= *flip_map_len= BLI_countlist(&ob->defbase);
 
-	if (totdg==0) {
+	if (defbase_tot==0) {
 		return NULL;
 	}
 	else {
 		bDeformGroup *dg;
 		char name[sizeof(dg->name)];
-		int i, flip_num, *map= MEM_mallocN(totdg * sizeof(int), __func__);
+		int i, flip_num, *map= MEM_mallocN(defbase_tot * sizeof(int), __func__);
 
-		for (i=0; i < totdg; i++) {
+		for (i=0; i < defbase_tot; i++) {
 			map[i]= -1;
 		}
 
@@ -321,17 +325,17 @@ int *defgroup_flip_map(Object *ob, int *flip_map_len, int use_default)
 /* note, must be freed */
 int *defgroup_flip_map_single(Object *ob, int *flip_map_len, int use_default, int defgroup)
 {
-	int totdg= *flip_map_len= BLI_countlist(&ob->defbase);
+	int defbase_tot= *flip_map_len= BLI_countlist(&ob->defbase);
 
-	if (totdg==0) {
+	if (defbase_tot==0) {
 		return NULL;
 	}
 	else {
 		bDeformGroup *dg;
 		char name[sizeof(dg->name)];
-		int i, flip_num, *map= MEM_mallocN(totdg * sizeof(int), __func__);
+		int i, flip_num, *map= MEM_mallocN(defbase_tot * sizeof(int), __func__);
 
-		for (i=0; i < totdg; i++) {
+		for (i=0; i < defbase_tot; i++) {
 			if (use_default) map[i]= i;
 			else             map[i]= -1;
 		}