diff options
| author | Antony Riakiotakis <kalast@gmail.com> | 2014-09-23 21:05:31 +0400 |
|---|---|---|
| committer | Antony Riakiotakis <kalast@gmail.com> | 2014-09-23 21:05:41 +0400 |
| commit | 39067824060f83d1da66df7bf8d779e9ebe7c76e (patch) | |
| tree | 15c1d500651c8d02114dfcfa644173636322e27b /source/blender/editors/space_view3d/view3d_select.c | |
| parent | e422e56db05813940c4e6f053634c95f3e9d50b9 (diff) | |
Fix possible buffer overflow in selection code. We want to copy the
number of selected data since the offset, not the offset!
Diffstat (limited to 'source/blender/editors/space_view3d/view3d_select.c')
| -rw-r--r-- | source/blender/editors/space_view3d/view3d_select.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/source/blender/editors/space_view3d/view3d_select.c b/source/blender/editors/space_view3d/view3d_select.c index 46ea52054c5..c26ce276dc3 100644 --- a/source/blender/editors/space_view3d/view3d_select.c +++ b/source/blender/editors/space_view3d/view3d_select.c @@ -1181,14 +1181,14 @@ static short selectbuffer_ret_hits_15(unsigned int *UNUSED(buffer), const short static short selectbuffer_ret_hits_9(unsigned int *buffer, const short hits15, const short hits9) { const int offs = 4 * hits15; - memcpy(buffer, buffer + offs, 4 * offs); + memcpy(buffer, buffer + offs, 4 * hits9); return hits9; } static short selectbuffer_ret_hits_5(unsigned int *buffer, const short hits15, const short hits9, const short hits5) { const int offs = 4 * hits15 + 4 * hits9; - memcpy(buffer, buffer + offs, 4 * offs); + memcpy(buffer, buffer + offs, 4 * hits5); return hits5; } |