Fix (unreported) use-after-free case in Properties Editor ID remapping code.

Regression in rBa21bca0e20a051, found while investigating T97069.

1 files changed, 7 insertions, 5 deletions

diff --git a/source/blender/editors/space_buttons/space_buttons.c b/source/blender/editors/space_buttons/space_buttons.c
index 1ec6832c6c3..1d0061ab7d8 100644
--- a/source/blender/editors/space_buttons/space_buttons.c
+++ b/source/blender/editors/space_buttons/space_buttons.c
@@ -861,12 +861,11 @@ static void buttons_id_remap(ScrArea *UNUSED(area),
     for (int i = 0; i < path->len; i++) {
       switch (BKE_id_remapper_apply(mappings, &path->ptr[i].owner_id, ID_REMAP_APPLY_DEFAULT)) {
         case ID_REMAP_RESULT_SOURCE_UNASSIGNED: {
-          if (i == 0) {
-            MEM_SAFE_FREE(sbuts->path);
-          }
-          else {
+          path->len = i;
+          if (i != 0) {
+            /* If the first item in the path is cleared, the whole path is cleared, so no need to
+             * clear further items here, see also at the end of this block. */
             memset(&path->ptr[i], 0, sizeof(path->ptr[i]) * (path->len - i));
-            path->len = i;
           }
           break;
         }
@@ -887,6 +886,9 @@ static void buttons_id_remap(ScrArea *UNUSED(area),
         }
       }
     }
+    if (path->len == 0) {
+      MEM_SAFE_FREE(sbuts->path);
+    }
   }
 
   if (sbuts->texuser) {