Fix for possible memory leak on creation of a vector using Vector.Range.

It was possible to allocate an array of size<2 which would then raise an error on vector creation without freeing.

Fix to ensure the behaviour of Vector.Range was the same as for builtin range() function. When specifying 3 arguments, the step argument wasn't being used to correctly calculate the vector size.

Minor formatting edits for error messages.

1 files changed, 16 insertions, 5 deletions

diff --git a/source/blender/python/mathutils/mathutils_Vector.c b/source/blender/python/mathutils/mathutils_Vector.c
index 5848e6e8c75..0ca8878c96a 100644
--- a/source/blender/python/mathutils/mathutils_Vector.c
+++ b/source/blender/python/mathutils/mathutils_Vector.c
@@ -174,7 +174,7 @@ static PyObject *C_Vector_Range(PyObject *cls, PyObject *args)
 	case 2:
 		if (start >= stop) {
 			PyErr_SetString(PyExc_RuntimeError,
-			                "Start value is larger"
+			                "Start value is larger "
 			                "than the stop value");
 			return NULL;
 		}
@@ -184,16 +184,27 @@ static PyObject *C_Vector_Range(PyObject *cls, PyObject *args)
 	default:
 		if (start >= stop) {
 			PyErr_SetString(PyExc_RuntimeError,
-			                "Start value is larger"
+			                "Start value is larger "
 			                "than the stop value");
 			return NULL;
 		}
-		size = (stop - start)/step;
-		if (size%step)
-			size++;
+
+		size = (stop - start);
+
+		if ((size % step) != 0)
+			size += step;
+
+		size /= step;
+
 		break;
 	}
 
+	if (size < 2) {
+		PyErr_SetString(PyExc_RuntimeError,
+		                "Vector(): invalid size");
+		return NULL;
+	}
+
 	vec = PyMem_Malloc(size * sizeof(float));
 
 	if (vec == NULL) {