From 6a885e5d89599d5acec8792bcb6aab49b6c4773c Mon Sep 17 00:00:00 2001 From: Campbell Barton Date: Wed, 15 Dec 2021 23:39:53 +1100 Subject: Fix meta-ball bound-box calculation reading past buffer bounds This broke "test_undo.view3d_multi_mode_select" test in "lib/tests/ui_simulate" and is likely exposed by recent changes to bounding box calculation. The missing check for DL_INDEX4 dates back to code from 2002 which intended to check this but was checking for DL_INDEX3 twice which got removed as part of a cleaned up. This could be hidden from memory checking tools as meta-balls over-allocate vertex arrays. --- source/blender/blenkernel/intern/displist.cc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/source/blender/blenkernel/intern/displist.cc b/source/blender/blenkernel/intern/displist.cc index a8a7b5c5af3..edf043de63f 100644 --- a/source/blender/blenkernel/intern/displist.cc +++ b/source/blender/blenkernel/intern/displist.cc @@ -1528,7 +1528,7 @@ void BKE_displist_minmax(const ListBase *dispbase, float min[3], float max[3]) bool doit = false; LISTBASE_FOREACH (const DispList *, dl, dispbase) { - const int tot = (dl->type == DL_INDEX3) ? dl->nr : dl->nr * dl->parts; + const int tot = (ELEM(dl->type, DL_INDEX3, DL_INDEX4)) ? dl->nr : dl->nr * dl->parts; for (const int i : IndexRange(tot)) { minmax_v3v3_v3(min, max, &dl->verts[i * 3]); } -- cgit v1.2.3