diff options
author | Bastien Montagne <bastien@blender.org> | 2022-04-12 19:11:08 +0300 |
---|---|---|
committer | Bastien Montagne <bastien@blender.org> | 2022-04-12 19:43:26 +0300 |
commit | 48014fbf1432de2ad74ef76280673062d9870af7 (patch) | |
tree | e7d7a0b7d636629fb7e3c158913ec68b820ee64f /source/blender/editors/space_buttons/space_buttons.c | |
parent | 77db370cb6e032d477bf48dbeb8bb608ba2b643f (diff) |
Fix (unreported) use-after-free case in Properties Editor ID remapping code.
Regression in rBa21bca0e20a051, found while investigating T97069.
Diffstat (limited to 'source/blender/editors/space_buttons/space_buttons.c')
-rw-r--r-- | source/blender/editors/space_buttons/space_buttons.c | 12 |
1 files changed, 7 insertions, 5 deletions
diff --git a/source/blender/editors/space_buttons/space_buttons.c b/source/blender/editors/space_buttons/space_buttons.c index 1ec6832c6c3..1d0061ab7d8 100644 --- a/source/blender/editors/space_buttons/space_buttons.c +++ b/source/blender/editors/space_buttons/space_buttons.c @@ -861,12 +861,11 @@ static void buttons_id_remap(ScrArea *UNUSED(area), for (int i = 0; i < path->len; i++) { switch (BKE_id_remapper_apply(mappings, &path->ptr[i].owner_id, ID_REMAP_APPLY_DEFAULT)) { case ID_REMAP_RESULT_SOURCE_UNASSIGNED: { - if (i == 0) { - MEM_SAFE_FREE(sbuts->path); - } - else { + path->len = i; + if (i != 0) { + /* If the first item in the path is cleared, the whole path is cleared, so no need to + * clear further items here, see also at the end of this block. */ memset(&path->ptr[i], 0, sizeof(path->ptr[i]) * (path->len - i)); - path->len = i; } break; } @@ -887,6 +886,9 @@ static void buttons_id_remap(ScrArea *UNUSED(area), } } } + if (path->len == 0) { + MEM_SAFE_FREE(sbuts->path); + } } if (sbuts->texuser) { |