diff options
| author | Fen <chemicalcrux> | 2021-06-18 04:13:09 +0300 |
|---|---|---|
| committer | Campbell Barton <ideasman42@gmail.com> | 2021-06-18 04:13:09 +0300 |
| commit | e178a273fa7f5c67a617d682b1387cb42a6987cb (patch) | |
| tree | bdcbeb5c733966ffc3f1ca0ac801cf3192d24509 /source/blender/bmesh/tools | |
| parent | 94c4a9995e43a5921adb33da80591e0c4cf3fe9b (diff) | |
Fix T89247: Dereference arguments to comparison function correctly
`bm_face_len_cmp` incorrectly interpreted its arguments as `BMFace *`
instead of `BMFace **`, causing an out-of-bounds read.
Ref D11637
Diffstat (limited to 'source/blender/bmesh/tools')
| -rw-r--r-- | source/blender/bmesh/tools/bmesh_region_match.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/source/blender/bmesh/tools/bmesh_region_match.c b/source/blender/bmesh/tools/bmesh_region_match.c index 561b00544b5..c538d5b17cd 100644 --- a/source/blender/bmesh/tools/bmesh_region_match.c +++ b/source/blender/bmesh/tools/bmesh_region_match.c @@ -553,7 +553,8 @@ static void bm_uuidwalk_pass_add(UUIDWalk *uuidwalk, static int bm_face_len_cmp(const void *v1, const void *v2) { - const BMFace *f1 = v1, *f2 = v2; + const BMFace *f1 = *((BMFace **)v1); + const BMFace *f2 = *((BMFace **)v2); if (f1->len > f2->len) { return 1; |