fix for possible buffer overflow in gpu_nodes_get_vertex_attributes() and hair_velocity_smoothing()

and a unlikely NULL pointer dereference in unlink_material_cb().

1 files changed, 13 insertions, 10 deletions

diff --git a/source/blender/gpu/intern/gpu_codegen.c b/source/blender/gpu/intern/gpu_codegen.c
index b90e67ac838..b4490e656f3 100644
--- a/source/blender/gpu/intern/gpu_codegen.c
+++ b/source/blender/gpu/intern/gpu_codegen.c
@@ -1046,17 +1046,20 @@ static void gpu_nodes_get_vertex_attributes(ListBase *nodes, GPUVertexAttribs *a
 					}
 				}
 
-				if (a == attribs->totlayer && a < GPU_MAX_ATTRIB) {
-					input->attribid = attribs->totlayer++;
-					input->attribfirst = 1;
-
-					attribs->layer[a].type = input->attribtype;
-					attribs->layer[a].attribid = input->attribid;
-					BLI_strncpy(attribs->layer[a].name, input->attribname,
-						sizeof(attribs->layer[a].name));
+				if (a < GPU_MAX_ATTRIB) {
+					if (a == attribs->totlayer) {
+						input->attribid = attribs->totlayer++;
+						input->attribfirst = 1;
+
+						attribs->layer[a].type = input->attribtype;
+						attribs->layer[a].attribid = input->attribid;
+						BLI_strncpy(attribs->layer[a].name, input->attribname,
+						            sizeof(attribs->layer[a].name));
+					}
+					else {
+						input->attribid = attribs->layer[a].attribid;
+					}
 				}
-				else
-					input->attribid = attribs->layer[a].attribid;
 			}
 		}
 	}