diff options
author | Campbell Barton <campbell@blender.org> | 2022-01-07 08:32:01 +0300 |
---|---|---|
committer | Campbell Barton <campbell@blender.org> | 2022-01-07 09:48:54 +0300 |
commit | f24854005d8688fb86cf41bd62a63580c63f818d (patch) | |
tree | 2c348e4453a199ebb54db26dba3db8ed1bce5526 /source/blender/editors | |
parent | 164202831032164ed52108b4a365b9ff9ca4ac84 (diff) |
Fix T94708: negative reference count error with Python API callbacks
Regression in 7972785d7b90771f50534fe3e1101d8adb615fa3 that caused
Python callback arguments to be de-referenced twice - potentially
accessing freed memory. Making a new-file with a circle-select
tool active triggered this (for example).
Now arguments aren't de-referenced when Blender it's self has already
removed the callback handle.
Diffstat (limited to 'source/blender/editors')
-rw-r--r-- | source/blender/editors/include/ED_space_api.h | 2 | ||||
-rw-r--r-- | source/blender/editors/space_api/spacetypes.c | 5 |
2 files changed, 4 insertions, 3 deletions
diff --git a/source/blender/editors/include/ED_space_api.h b/source/blender/editors/include/ED_space_api.h index f4a69737da1..fb76b36baef 100644 --- a/source/blender/editors/include/ED_space_api.h +++ b/source/blender/editors/include/ED_space_api.h @@ -86,7 +86,7 @@ void *ED_region_draw_cb_activate(struct ARegionType *art, int type); void ED_region_draw_cb_draw(const struct bContext *C, struct ARegion *region, int type); void ED_region_surface_draw_cb_draw(struct ARegionType *art, int type); -void ED_region_draw_cb_exit(struct ARegionType *art, void *handle); +bool ED_region_draw_cb_exit(struct ARegionType *art, void *handle); void ED_region_draw_cb_remove_by_type(struct ARegionType *art, void *draw_fn, void (*free)(void *)); diff --git a/source/blender/editors/space_api/spacetypes.c b/source/blender/editors/space_api/spacetypes.c index 93d023c8bb4..f8adba30547 100644 --- a/source/blender/editors/space_api/spacetypes.c +++ b/source/blender/editors/space_api/spacetypes.c @@ -248,15 +248,16 @@ void *ED_region_draw_cb_activate(ARegionType *art, return rdc; } -void ED_region_draw_cb_exit(ARegionType *art, void *handle) +bool ED_region_draw_cb_exit(ARegionType *art, void *handle) { LISTBASE_FOREACH (RegionDrawCB *, rdc, &art->drawcalls) { if (rdc == (RegionDrawCB *)handle) { BLI_remlink(&art->drawcalls, rdc); MEM_freeN(rdc); - return; + return true; } } + return false; } static void ed_region_draw_cb_draw(const bContext *C, ARegion *region, ARegionType *art, int type) |