diff options
author | Hans Goudey <h.goudey@me.com> | 2021-09-15 02:13:52 +0300 |
---|---|---|
committer | Hans Goudey <h.goudey@me.com> | 2021-09-15 02:13:52 +0300 |
commit | e6fa74ffed5ffaf2a7cd550415d8216883fd1961 (patch) | |
tree | 9e7e84999aa01bcd1300cdf04cc60d992ebafaa1 /source | |
parent | 7c7348f78d1b094c4fdc20f2c9dbfe521b68c11e (diff) |
Fix: Use after free in spreadsheet attribute column ID
A temporary string was created in the attribute_foreach callback
and used in a map at a higher scope. When the callback finished,
the string went out of scope, was freed, then the elements in the
set pointed to freed memory.
Diffstat (limited to 'source')
-rw-r--r-- | source/blender/editors/space_spreadsheet/spreadsheet_data_source_geometry.cc | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/source/blender/editors/space_spreadsheet/spreadsheet_data_source_geometry.cc b/source/blender/editors/space_spreadsheet/spreadsheet_data_source_geometry.cc index bd2d89e4f27..78d9f61d8d5 100644 --- a/source/blender/editors/space_spreadsheet/spreadsheet_data_source_geometry.cc +++ b/source/blender/editors/space_spreadsheet/spreadsheet_data_source_geometry.cc @@ -54,8 +54,7 @@ void GeometryDataSource::foreach_default_column_ids( return true; } SpreadsheetColumnID column_id; - std::string name = attribute_id.name(); - column_id.name = (char *)name.c_str(); + column_id.name = (char *)attribute_id.name().data(); fn(column_id); return true; }); |