fix for possible buffer overflow in gpu_nodes_get_vertex_attributes() and hair_velocity_smoothing()

and a unlikely NULL pointer dereference in unlink_material_cb().

2 files changed, 8 insertions, 3 deletions

diff --git a/source/blender/blenkernel/intern/implicit.c b/source/blender/blenkernel/intern/implicit.c
index 39dcd73e0e5..92ac7b60207 100644
--- a/source/blender/blenkernel/intern/implicit.c
+++ b/source/blender/blenkernel/intern/implicit.c
@@ -1513,7 +1513,7 @@ static void hair_velocity_smoothing(ClothModifierData *clmd, lfVector *lF, lfVec
 		i = HAIR_GRID_INDEX(lX[v], gmin, gmax, 0);
 		j = HAIR_GRID_INDEX(lX[v], gmin, gmax, 1);
 		k = HAIR_GRID_INDEX(lX[v], gmin, gmax, 2);
-		if (i < 0 || j < 0 || k < 0 || i > 10 || j >= 10 || k >= 10)
+		if (i < 0 || j < 0 || k < 0 || i > 10 || j > 10 || k > 10)
 			continue;
 
 		lF[v][0] += smoothfac * (grid[i][j][k].velocity[0] - lV[v][0]);
diff --git a/source/blender/blenkernel/intern/mball.c b/source/blender/blenkernel/intern/mball.c
index 592101fbd31..5da7ff86e61 100644
--- a/source/blender/blenkernel/intern/mball.c
+++ b/source/blender/blenkernel/intern/mball.c
@@ -1319,12 +1319,16 @@ static void addtovertices(VERTICES *vertices, VERTEX v)
 
 static void vnormal(const float point[3], PROCESS *p, float r_no[3])
 {
-	float delta = 0.2f * p->delta;
-	float f = p->function(point[0], point[1], point[2]);
+	const float delta = 0.2f * p->delta;
+	const float f = p->function(point[0], point[1], point[2]);
 
 	r_no[0] = p->function(point[0] + delta, point[1], point[2]) - f;
 	r_no[1] = p->function(point[0], point[1] + delta, point[2]) - f;
 	r_no[2] = p->function(point[0], point[1], point[2] + delta) - f;
+
+#if 1
+	normalize_v3(r_no);
+#else
 	f = normalize_v3(r_no);
 	
 	if (0) {
@@ -1343,6 +1347,7 @@ static void vnormal(const float point[3], PROCESS *p, float r_no[3])
 			normalize_v3(r_no);
 		}
 	}
+#endif
 }