bugfix [#23270] Long directory name segmentation fault in File brower

 file->relname was being edited when its length allocated at the size of the original name, realloc'ing failed because the old string was still used by a button.

3 files changed, 11 insertions, 5 deletions

diff --git a/source/blender/editors/space_file/file_draw.c b/source/blender/editors/space_file/file_draw.c
index 22c5270ae6d..f25fab45c7c 100644
--- a/source/blender/editors/space_file/file_draw.c
+++ b/source/blender/editors/space_file/file_draw.c
@@ -426,21 +426,25 @@ static void renamebutton_cb(bContext *C, void *arg1, char *oldname)
 	SpaceFile *sfile= (SpaceFile*)CTX_wm_space_data(C);
 	ARegion* ar = CTX_wm_region(C);
 
+#if 0
 	struct direntry *file = (struct direntry *)arg1;
+#endif
 
 	BLI_make_file_string(G.sce, orgname, sfile->params->dir, oldname);
-	BLI_strncpy(filename, file->relname, sizeof(filename));
+	BLI_strncpy(filename, sfile->params->renameedit, sizeof(filename));
 	BLI_make_file_string(G.sce, newname, sfile->params->dir, filename);
 
 	if( strcmp(orgname, newname) != 0 ) {
 		if (!BLI_exists(newname)) {
 			BLI_rename(orgname, newname);
 			/* to make sure we show what is on disk */
+#if 0		/* this is cleared anyway, no need */
+			MEM_freeN(file->relname);
+			file->relname= BLI_strdup(sfile->params->renameedit);
+#endif
 			ED_fileselect_clear(C, sfile);
-		} else {
-			BLI_strncpy(file->relname, oldname, strlen(oldname)+1);
 		}
-		
+
 		ED_region_tag_redraw(ar);
 	}
 }
@@ -535,7 +539,7 @@ void file_draw_list(const bContext *C, ARegion *ar)
 			int but_width = (FILE_IMGDISPLAY == params->display) ? layout->tile_w : layout->column_widths[COLUMN_NAME];
 
 			uiBut *but = uiDefBut(block, TEX, 1, "", spos, sy-layout->tile_h-3, 
-				but_width, layout->textheight*2, file->relname, 1.0f, (float)FILE_MAX,0,0,"");
+				but_width, layout->textheight*2, sfile->params->renameedit, 1.0f, (float)sizeof(sfile->params->renameedit),0,0,"");
 			uiButSetRenameFunc(but, renamebutton_cb, file);
 			if ( 0 == uiButActiveOnly(C, block, but)) {
 				file->flags &= ~EDITING;
diff --git a/source/blender/editors/space_file/space_file.c b/source/blender/editors/space_file/space_file.c
index 2f023aeebc1..7b9423332f2 100644
--- a/source/blender/editors/space_file/space_file.c
+++ b/source/blender/editors/space_file/space_file.c
@@ -232,6 +232,7 @@ static void file_refresh(const bContext *C, ScrArea *sa)
 				file->flags |= EDITING;
 			}
 		}
+		BLI_strncpy(sfile->params->renameedit, sfile->params->renamefile, sizeof(sfile->params->renameedit));
 		params->renamefile[0] = '\0';
 	}
 	if (sfile->layout) sfile->layout->dirty= 1;
diff --git a/source/blender/makesdna/DNA_space_types.h b/source/blender/makesdna/DNA_space_types.h
index c365d33a9a4..bf64bc27b48 100644
--- a/source/blender/makesdna/DNA_space_types.h
+++ b/source/blender/makesdna/DNA_space_types.h
@@ -161,6 +161,7 @@ typedef struct FileSelectParams {
 	char dir[240]; /* directory */
 	char file[80]; /* file */
 	char renamefile[80];
+	char renameedit[80]; /* annoying but the first is only used for initialization */
 
 	short type; /* XXXXX for now store type here, should be moved to the operator */
 	short flag; /* settings for filter, hiding dots files,...  */