fix [#27158] Appending crash with preview.

* fixed incorrect reading of PreviewImage struct from .blend 
* fixed memory leak, PreviewImage data wasn't correctly free'd

3 files changed, 34 insertions, 28 deletions

diff --git a/source/blender/blenloader/BLO_readfile.h b/source/blender/blenloader/BLO_readfile.h
index b7a1e0dc592..6267b819c55 100644
--- a/source/blender/blenloader/BLO_readfile.h
+++ b/source/blender/blenloader/BLO_readfile.h
@@ -49,6 +49,8 @@ struct SpaceFile;
 struct SpaceImaSel;
 struct UserDef;
 struct bContext;
+struct BHead;
+struct FileData;
 
 typedef struct BlendHandle	BlendHandle;
 
@@ -225,6 +227,8 @@ struct Main* BLO_library_append_begin(const struct bContext *C, BlendHandle** bh
 int BLO_library_append_named_part(const struct bContext *C, struct Main *mainl, BlendHandle** bh, const char *idname, int idcode, short flag);
 void BLO_library_append_end(const struct bContext *C, struct Main *mainl, BlendHandle** bh, int idcode, short flag);
 
+void *BLO_library_read_struct(struct FileData *fd, struct BHead *bh, const char *blockname);
+
 /* deprecated */
 #if 1
 void BLO_script_library_append(BlendHandle **bh, char *dir, char *name, int idcode, short flag, struct Main *mainvar, struct Scene *scene, struct ReportList *reports);
diff --git a/source/blender/blenloader/intern/readblenentry.c b/source/blender/blenloader/intern/readblenentry.c
index 028835ee0af..4ce5685ff18 100644
--- a/source/blender/blenloader/intern/readblenentry.c
+++ b/source/blender/blenloader/intern/readblenentry.c
@@ -148,15 +148,14 @@ LinkNode *BLO_blendhandle_get_previews(BlendHandle *bh, int ofblocktype, int *to
 	LinkNode *previews= NULL;
 	BHead *bhead;
 	int looking=0;
-	int npreviews = 0;
 	PreviewImage* prv = NULL;
 	PreviewImage* new_prv = NULL;
 	int tot= 0;
 	
 	for (bhead= blo_firstbhead(fd); bhead; bhead= blo_nextbhead(fd, bhead)) {
 		if (bhead->code==ofblocktype) {
-			ID *id= (ID*) (bhead+1);
-			switch(GS(id->name))
+			char *idname= bhead_id_name(fd, bhead);
+			switch(GS(idname))
 			{
 				case ID_MA: /* fall through */
 				case ID_TE: /* fall through */
@@ -174,31 +173,29 @@ LinkNode *BLO_blendhandle_get_previews(BlendHandle *bh, int ofblocktype, int *to
 		} else if (bhead->code==DATA) {
 			if (looking) {
 				if (bhead->SDNAnr == DNA_struct_find_nr(fd->filesdna, "PreviewImage") ) {
-					prv = (PreviewImage*) (bhead+1);
-					npreviews = 0;				
-					memcpy(new_prv, prv, sizeof(PreviewImage));
-					if (prv->rect[0]) {
-						unsigned int *rect = NULL;
-						// int rectlen = 0;
-						new_prv->rect[0] = MEM_callocN(new_prv->w[0]*new_prv->h[0]*sizeof(unsigned int), "prvrect");
-						bhead= blo_nextbhead(fd, bhead);
-						rect = (unsigned int*)(bhead+1);
-						// rectlen = new_prv->w[0]*new_prv->h[0]*sizeof(unsigned int);
-						memcpy(new_prv->rect[0], rect, bhead->len);					
-					} else {
-						new_prv->rect[0] = NULL;
-					}
-					
-					if (prv->rect[1]) {
-						unsigned int *rect = NULL;
-						// int rectlen = 0;
-						new_prv->rect[1] = MEM_callocN(new_prv->w[1]*new_prv->h[1]*sizeof(unsigned int), "prvrect");
-						bhead= blo_nextbhead(fd, bhead);
-						rect = (unsigned int*)(bhead+1);
-						// rectlen = new_prv->w[1]*new_prv->h[1]*sizeof(unsigned int);
-						memcpy(new_prv->rect[1], rect, bhead->len);							
-					} else {
-						new_prv->rect[1] = NULL;
+					prv = BLO_library_read_struct(fd, bhead, "PreviewImage");	
+					if (prv) {
+						memcpy(new_prv, prv, sizeof(PreviewImage));
+						if (prv->rect[0]) {
+							unsigned int *rect = NULL;
+							new_prv->rect[0] = MEM_callocN(new_prv->w[0]*new_prv->h[0]*sizeof(unsigned int), "prvrect");
+							bhead= blo_nextbhead(fd, bhead);
+							rect = (unsigned int*)(bhead+1);
+							memcpy(new_prv->rect[0], rect, bhead->len);					
+						} else {
+							new_prv->rect[0] = NULL;
+						}
+						
+						if (prv->rect[1]) {
+							unsigned int *rect = NULL;
+							new_prv->rect[1] = MEM_callocN(new_prv->w[1]*new_prv->h[1]*sizeof(unsigned int), "prvrect");
+							bhead= blo_nextbhead(fd, bhead);
+							rect = (unsigned int*)(bhead+1);
+							memcpy(new_prv->rect[1], rect, bhead->len);							
+						} else {
+							new_prv->rect[1] = NULL;
+						}
+						MEM_freeN(prv);
 					}
 				}
 			}
diff --git a/source/blender/blenloader/intern/readfile.c b/source/blender/blenloader/intern/readfile.c
index 08b63dd128f..c25f9d9e044 100644
--- a/source/blender/blenloader/intern/readfile.c
+++ b/source/blender/blenloader/intern/readfile.c
@@ -13030,6 +13030,11 @@ void BLO_library_append_end(const bContext *C, struct Main *mainl, BlendHandle**
 	*bh= (BlendHandle*)fd;
 }
 
+void *BLO_library_read_struct(FileData *fd, BHead *bh, const char *blockname)
+{
+	return read_struct(fd, bh, blockname);
+}
+
 /* ************* READ LIBRARY ************** */
 
 static int mainvar_count_libread_blocks(Main *mainvar)