fix for incorrect array use when freeing fcurve modifier envelope points, array also wasnt NULL'd on freeing which gave memory errors later on.

1 files changed, 6 insertions, 4 deletions

diff --git a/source/blender/editors/animation/fmodifier_ui.c b/source/blender/editors/animation/fmodifier_ui.c
index 390b9f840cb..d14ebc2c7bb 100644
--- a/source/blender/editors/animation/fmodifier_ui.c
+++ b/source/blender/editors/animation/fmodifier_ui.c
@@ -443,9 +443,9 @@ static void fmod_envelope_deletepoint_cb (bContext *UNUSED(C), void *fcm_dv, voi
 	if (env->totvert > 1) {
 		/* allocate a new smaller array */
 		fedn= MEM_callocN(sizeof(FCM_EnvelopeData)*(env->totvert-1), "FCM_EnvelopeData");
-		
-		memcpy(fedn, &env->data, sizeof(FCM_EnvelopeData)*(index));
-		memcpy(&fedn[index], &env->data[index+1], sizeof(FCM_EnvelopeData)*(env->totvert-index-1));
+
+		memcpy(fedn, env->data, sizeof(FCM_EnvelopeData)*(index));
+		memcpy(fedn + index, env->data + (index + 1), sizeof(FCM_EnvelopeData)*((env->totvert - index)-1));
 		
 		/* free old array, and set the new */
 		MEM_freeN(env->data);
@@ -454,8 +454,10 @@ static void fmod_envelope_deletepoint_cb (bContext *UNUSED(C), void *fcm_dv, voi
 	}
 	else {
 		/* just free array, since the only vert was deleted */
-		if (env->data) 
+		if (env->data) {
 			MEM_freeN(env->data);
+			env->data= NULL;
+		}
 		env->totvert= 0;
 	}
 }