From 7f3649874070de38131263317d02906d50279f93 Mon Sep 17 00:00:00 2001
From: Jeroen Bakker <jeroen@blender.org>
Date: Tue, 2 Mar 2021 16:20:00 +0100
Subject: Fix T86026: Crash Opening Cryptomatte File.

Not sure this fixes the root cause. It seems that memory corruption
happens in dynstr. This patch replaces dynstr with a streamstring.
---
 source/blender/blenkernel/intern/cryptomatte.cc    | 22 +++++++++++++++-------
 .../blender/blenkernel/intern/cryptomatte_test.cc  | 13 +++++++++++++
 2 files changed, 28 insertions(+), 7 deletions(-)

diff --git a/source/blender/blenkernel/intern/cryptomatte.cc b/source/blender/blenkernel/intern/cryptomatte.cc
index a20c53ed270..8a6b89ce19e 100644
--- a/source/blender/blenkernel/intern/cryptomatte.cc
+++ b/source/blender/blenkernel/intern/cryptomatte.cc
@@ -184,22 +184,30 @@ float BKE_cryptomatte_hash_to_float(uint32_t cryptomatte_hash)
 
 char *BKE_cryptomatte_entries_to_matte_id(NodeCryptomatte *node_storage)
 {
-  DynStr *matte_id = BLI_dynstr_new();
+  std::stringstream ss;
+  ss.precision(9);
+
   bool first = true;
   LISTBASE_FOREACH (CryptomatteEntry *, entry, &node_storage->entries) {
     if (!first) {
-      BLI_dynstr_append(matte_id, ",");
+      ss << ',';
     }
-    if (BLI_strnlen(entry->name, sizeof(entry->name)) != 0) {
-      BLI_dynstr_nappend(matte_id, entry->name, sizeof(entry->name));
+    blender::StringRef entry_name(entry->name, BLI_strnlen(entry->name, sizeof(entry->name)));
+    if (!entry_name.is_empty()) {
+      ss << entry_name;
     }
     else {
-      BLI_dynstr_appendf(matte_id, "<%.9g>", entry->encoded_hash);
+      ss << '<' << std::scientific << entry->encoded_hash << '>';
     }
     first = false;
   }
-  char *result = BLI_dynstr_get_cstring(matte_id);
-  BLI_dynstr_free(matte_id);
+
+  /* Convert result to C string. */
+  const std::string result_string = ss.str();
+  const char *c_str = result_string.c_str();
+  size_t result_len = result_string.size() + 1;
+  char *result = static_cast<char *>(MEM_mallocN(sizeof(char) * result_len, __func__));
+  memcpy(result, c_str, result_len);
   return result;
 }
 
diff --git a/source/blender/blenkernel/intern/cryptomatte_test.cc b/source/blender/blenkernel/intern/cryptomatte_test.cc
index d9be252d654..5481b97913c 100644
--- a/source/blender/blenkernel/intern/cryptomatte_test.cc
+++ b/source/blender/blenkernel/intern/cryptomatte_test.cc
@@ -21,6 +21,8 @@
 #include "BKE_cryptomatte.hh"
 #include "BKE_image.h"
 
+#include "DNA_node_types.h"
+
 #include "RE_pipeline.h"
 
 #include "MEM_guardedalloc.h"
@@ -176,4 +178,15 @@ TEST(cryptomatte, session_from_stamp_data)
   BKE_cryptomatte_free(session);
 }
 
+TEST(cryptomatte, T86026)
+{
+  NodeCryptomatte storage = {{0.0f}};
+  CryptomatteEntry entry = {nullptr};
+  BLI_addtail(&storage.entries, &entry);
+  entry.encoded_hash = 4.76190593e-07;
+  char *matte_id = BKE_cryptomatte_entries_to_matte_id(&storage);
+  EXPECT_STREQ("<4.761905927e-07>", matte_id);
+  MEM_freeN(matte_id);
+}
+
 }  // namespace blender::bke::cryptomatte::tests
-- 
cgit v1.2.3