Fix T71260: GPencil crash when drawing very long lines

There were two problems:

1) When the buffer was reallocate, the pointer was corrupted.
2) Short variables were too small to hold long lines.

4 files changed, 9 insertions, 10 deletions

diff --git a/source/blender/editors/gpencil/gpencil_paint.c b/source/blender/editors/gpencil/gpencil_paint.c
index f29e782c618..bebdcb34326 100644
--- a/source/blender/editors/gpencil/gpencil_paint.c
+++ b/source/blender/editors/gpencil/gpencil_paint.c
@@ -3660,7 +3660,6 @@ static int gpencil_draw_modal(bContext *C, wmOperator *op, const wmEvent *event)
   tGPsdata *p = op->customdata;
   ToolSettings *ts = CTX_data_tool_settings(C);
   GP_Sculpt_Guide *guide = &p->scene->toolsettings->gp_sculpt.guide;
-  tGPspoint *points = (tGPspoint *)p->gpd->runtime.sbuffer;
 
   /* default exit state - pass through to support MMB view nav, etc. */
   int estate = OPERATOR_PASS_THROUGH;
@@ -3969,6 +3968,7 @@ static int gpencil_draw_modal(bContext *C, wmOperator *op, const wmEvent *event)
       int size_after = p->gpd->runtime.sbuffer_used;
 
       /* Last point of the event is always real (not fake). */
+      tGPspoint *points = (tGPspoint *)p->gpd->runtime.sbuffer;
       tGPspoint *pt = &points[size_after - 1];
       pt->tflag &= ~GP_TPOINT_FAKE;
 
diff --git a/source/blender/editors/gpencil/gpencil_utils.c b/source/blender/editors/gpencil/gpencil_utils.c
index b194d28a8b8..3ca993673d4 100644
--- a/source/blender/editors/gpencil/gpencil_utils.c
+++ b/source/blender/editors/gpencil/gpencil_utils.c
@@ -2530,8 +2530,8 @@ void ED_gpencil_select_toggle_all(bContext *C, int action)
 
 /* Ensure the SBuffer (while drawing stroke) size is enough to save all points of the stroke */
 tGPspoint *ED_gpencil_sbuffer_ensure(tGPspoint *buffer_array,
-                                     short *buffer_size,
-                                     short *buffer_used,
+                                     int *buffer_size,
+                                     int *buffer_used,
                                      const bool clear)
 {
   tGPspoint *p = NULL;
diff --git a/source/blender/editors/include/ED_gpencil.h b/source/blender/editors/include/ED_gpencil.h
index 0ff1b8bb40b..dce0e3931be 100644
--- a/source/blender/editors/include/ED_gpencil.h
+++ b/source/blender/editors/include/ED_gpencil.h
@@ -292,8 +292,8 @@ void ED_gpencil_select_toggle_all(struct bContext *C, int action);
 
 /* Ensure stroke sbuffer size is enough */
 struct tGPspoint *ED_gpencil_sbuffer_ensure(struct tGPspoint *buffer_array,
-                                            short *buffer_size,
-                                            short *buffer_used,
+                                            int *buffer_size,
+                                            int *buffer_used,
                                             const bool clear);
 /* Tag all scene grease pencil object to update. */
 void ED_gpencil_tag_scene_gpencil(struct Scene *scene);
diff --git a/source/blender/makesdna/DNA_gpencil_types.h b/source/blender/makesdna/DNA_gpencil_types.h
index 1435d0a64b4..33dfe66a151 100644
--- a/source/blender/makesdna/DNA_gpencil_types.h
+++ b/source/blender/makesdna/DNA_gpencil_types.h
@@ -447,17 +447,16 @@ typedef struct bGPdata_Runtime {
    * - buffer must be initialized before use, but freed after
    *   whole paint operation is over
    */
-  /** Number of elements currently used in cache. */
-  short sbuffer_used;
   /** Flags for stroke that cache represents. */
   short sbuffer_sflag;
+  /** Number of elements currently used in cache. */
+  int sbuffer_used;
   /** Number of total elements available in cache. */
-  short sbuffer_size;
-  char _pad[4];
+  int sbuffer_size;
 
   /** Number of control-points for stroke. */
   int tot_cp_points;
-  char _pad1_[4];
+  char _pad_[4];
   /** Array of control-points for stroke. */
   bGPDcontrolpoint *cp_points;
 } bGPdata_Runtime;