Bug fix, provided by Martin Dickopp;

The dynamical allocated arrays (rwenzlaff, april 03) for render vertices/
faces/halos were freed in a way that requires the last element of array to
be NULL.
This wasn't coded however, causing memory errors in exceptional cases;
like when amount of faces/vertices is exact between 261888 and 262144. :)

2 files changed, 23 insertions, 20 deletions

diff --git a/source/blender/render/intern/source/renderdatabase.c b/source/blender/render/intern/source/renderdatabase.c
index 2e519591afc..50ddc26fead 100644
--- a/source/blender/render/intern/source/renderdatabase.c
+++ b/source/blender/render/intern/source/renderdatabase.c
@@ -85,13 +85,13 @@ VertRen *RE_findOrAddVert(int nr)
 	}
 	a= nr>>8;
 	
-	if (a>=rblovelen){  /* Need to allocate more columns...*/
-		// printf("Allocating %i more vert groups.  %i total.\n", 
+	if (a>=rblovelen-1){  /* Need to allocate more columns..., and keep last element NULL for free loop */
+		//printf("Allocating %i more vert groups.  %i total.\n", 
 		//	TABLEINITSIZE, rblovelen+TABLEINITSIZE );
 		temp=R.blove;
 		R.blove=(VertRen**)MEM_callocN(sizeof(void*)*(rblovelen+TABLEINITSIZE) , "Blove");
 		memcpy(R.blove, temp, rblovelen*sizeof(void*));
-		memset(&(R.blove[a]), 0, TABLEINITSIZE*sizeof(void*));
+		memset(&(R.blove[rblovelen]), 0, TABLEINITSIZE*sizeof(void*));
 		rblovelen+=TABLEINITSIZE; 
 		MEM_freeN(temp);	
 	}
@@ -118,13 +118,13 @@ HaloRen *RE_findOrAddHalo(int nr)
 	}
 	a= nr>>8;
 	
-	if (a>=rblohalen){  /* Need to allocate more columns...*/
+	if (a>=rblohalen-1){  /* Need to allocate more columns..., and keep last element NULL for free loop */
 		//printf("Allocating %i more halo groups.  %i total.\n", 
 		//	TABLEINITSIZE, rblohalen+TABLEINITSIZE );
 		temp=R.bloha;
-		R.bloha=(HaloRen**)MEM_callocN(sizeof(void*)*(rblohalen+TABLEINITSIZE) , "Blove");
+		R.bloha=(HaloRen**)MEM_callocN(sizeof(void*)*(rblohalen+TABLEINITSIZE) , "Bloha");
 		memcpy(R.bloha, temp, rblohalen*sizeof(void*));
-		memset(&(R.bloha[a]), 0, TABLEINITSIZE*sizeof(void*));
+		memset(&(R.bloha[rblohalen]), 0, TABLEINITSIZE*sizeof(void*));
 		rblohalen+=TABLEINITSIZE;  /*Does this really need to be power of 2?*/
 		MEM_freeN(temp);	
 	}
@@ -152,13 +152,13 @@ VlakRen *RE_findOrAddVlak(int nr)
 	}
 	a= nr>>8;
 	
-	if (a>=rblovllen){  /* Need to allocate more columns...*/
+	if (a>=rblovllen-1){  /* Need to allocate more columns..., and keep last element NULL for free loop */
 		// printf("Allocating %i more face groups.  %i total.\n", 
 		//	TABLEINITSIZE, rblovllen+TABLEINITSIZE );
 		temp=R.blovl;
-		R.blovl=(VlakRen**)MEM_callocN(sizeof(void*)*(rblovllen+TABLEINITSIZE) , "Blove");
+		R.blovl=(VlakRen**)MEM_callocN(sizeof(void*)*(rblovllen+TABLEINITSIZE) , "Blovl");
 		memcpy(R.blovl, temp, rblovllen*sizeof(void*));
-		memset(&(R.blovl[a]), 0, TABLEINITSIZE*sizeof(void*));
+		memset(&(R.blovl[rblovllen]), 0, TABLEINITSIZE*sizeof(void*));
 		rblovllen+=TABLEINITSIZE;  /*Does this really need to be power of 2?*/
 		MEM_freeN(temp);	
 	}
diff --git a/source/blender/renderconverter/intern/convertBlenderScene.c b/source/blender/renderconverter/intern/convertBlenderScene.c
index a74f1f16aad..0a582a079cd 100644
--- a/source/blender/renderconverter/intern/convertBlenderScene.c
+++ b/source/blender/renderconverter/intern/convertBlenderScene.c
@@ -961,6 +961,14 @@ static void render_particle_system(Object *ob, PartEff *paf)
 
 /* ------------------------------------------------------------------------- */
 
+/* when objects are duplicated, they are freed immediate, but still might be
+in use for render... */
+static Object *vlr_set_ob(Object *ob)
+{
+	if(ob->flag & OB_FROMDUPLI) return (Object *)ob->id.newid;
+	return ob;
+}
+
 static void render_static_particle_system(Object *ob, PartEff *paf)
 {
 	Particle *pa=0;
@@ -1175,14 +1183,6 @@ static Material *give_render_material(Object *ob, int nr)
 	return ma;
 }
 
-/* when objects are duplicated, they are freed immediate, but still might be
-   in use for render... */
-static Object *vlr_set_ob(Object *ob)
-{
-	if(ob->flag & OB_FROMDUPLI) return (Object *)ob->newid;
-	return ob;
-}
-
 /* ------------------------------------------------------------------------- */
 static void init_render_mball(Object *ob)
 {
@@ -2703,22 +2703,25 @@ void RE_freeRotateBlenderScene(void)
 		if(R.la[a]->jitter) MEM_freeN(R.la[a]->jitter);
 		MEM_freeN(R.la[a]);
 	}
+
+	/* note; these pointer arrays were allocated, with last element NULL to stop loop */
 	a=0;
 	while(R.blove[a]) {
 		MEM_freeN(R.blove[a]);
-		R.blove[a]=0;
+		R.blove[a]= NULL;
 		a++;
 	}
+
 	a=0;
 	while(R.blovl[a]) {
 		MEM_freeN(R.blovl[a]);
-		R.blovl[a]=0;
+		R.blovl[a]= NULL;
 		a++;
 	}
 	a=0;
 	while(R.bloha[a]) {
 		MEM_freeN(R.bloha[a]);
-		R.bloha[a]=0;
+		R.bloha[a]= NULL;
 		a++;
 	}