diff options
author | Jacques Lucke <jacques@blender.org> | 2021-10-13 16:36:52 +0300 |
---|---|---|
committer | Jacques Lucke <jacques@blender.org> | 2021-10-13 16:37:17 +0300 |
commit | d4e8390e95d9663a32012dcc39a9bbe08330e75b (patch) | |
tree | 0232517e6bea37372843933ab235f1434b96f49d /source/blender | |
parent | 518365395152e516af235366f4be908a40343b87 (diff) |
Fix T92153: use-after-free with anonymous attributes
Differential Revision: https://developer.blender.org/D12851
Diffstat (limited to 'source/blender')
-rw-r--r-- | source/blender/blenkernel/intern/anonymous_attribute.cc | 1 | ||||
-rw-r--r-- | source/blender/blenkernel/intern/customdata.c | 5 |
2 files changed, 6 insertions, 0 deletions
diff --git a/source/blender/blenkernel/intern/anonymous_attribute.cc b/source/blender/blenkernel/intern/anonymous_attribute.cc index 67611053d83..22c2f83e8be 100644 --- a/source/blender/blenkernel/intern/anonymous_attribute.cc +++ b/source/blender/blenkernel/intern/anonymous_attribute.cc @@ -97,6 +97,7 @@ void BKE_anonymous_attribute_id_decrement_weak(const AnonymousAttributeID *anony { const int new_refcount = anonymous_id->refcount_tot.fetch_sub(1) - 1; if (new_refcount == 0) { + BLI_assert(anonymous_id->refcount_strong == 0); delete anonymous_id; } } diff --git a/source/blender/blenkernel/intern/customdata.c b/source/blender/blenkernel/intern/customdata.c index 3bb02e1856b..d86b8163ebc 100644 --- a/source/blender/blenkernel/intern/customdata.c +++ b/source/blender/blenkernel/intern/customdata.c @@ -2595,6 +2595,11 @@ static CustomDataLayer *customData_add_layer__internal(CustomData *data, data->layers[index] = data->layers[index - 1]; } + /* Clear remaining data on the layer. The original data on the layer has been moved to another + * index. Without this, it can happen that information from the previous layer at that index + * leaks into the new layer. */ + memset(data->layers + index, 0, sizeof(CustomDataLayer)); + data->layers[index].type = type; data->layers[index].flag = flag; data->layers[index].data = newlayerdata; |