diff options
| author | Campbell Barton <ideasman42@gmail.com> | 2013-01-03 11:53:30 +0400 |
|---|---|---|
| committer | Campbell Barton <ideasman42@gmail.com> | 2013-01-03 11:53:30 +0400 |
| commit | 7b212b3bd0b583fc45ddaa8e500f482659ad1bab (patch) | |
| tree | f2276d3e96b508873d1a60107806ef1539524412 /source | |
| parent | 84f229536afceb78e10ebc7f5ff443eb01692188 (diff) | |
fix [#33689] Crash with decimate modifier
in fact a more general bug in BM_face_create_ngon() where edges containing the same vertex multiple times were not accounted for.
Diffstat (limited to 'source')
| -rw-r--r-- | source/blender/bmesh/intern/bmesh_construct.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/source/blender/bmesh/intern/bmesh_construct.c b/source/blender/bmesh/intern/bmesh_construct.c index 468a80f44f8..53ce5728879 100644 --- a/source/blender/bmesh/intern/bmesh_construct.c +++ b/source/blender/bmesh/intern/bmesh_construct.c @@ -215,6 +215,11 @@ BMFace *BM_face_create_ngon(BMesh *bm, BMVert *v1, BMVert *v2, BMEdge **edges, i do { BMEdge *e2 = e; + /* vertex array is (len + 1) */ + if (UNLIKELY(v_index > len)) { + goto err; /* vertex in loop twice */ + } + verts[v_index++] = v; edges2[e2_index++] = e; |