From f6665f506b0a7cb5251501eca37a8e2e9d7bafc1 Mon Sep 17 00:00:00 2001 From: Campbell Barton Date: Thu, 5 Aug 2021 16:44:01 +1000 Subject: Fix T89450: Crash slicing BMEditSelSeq Slicing with indices greater than the length of the sequence would crash. --- source/blender/python/bmesh/bmesh_py_types_select.c | 19 +++++-------------- 1 file changed, 5 insertions(+), 14 deletions(-) diff --git a/source/blender/python/bmesh/bmesh_py_types_select.c b/source/blender/python/bmesh/bmesh_py_types_select.c index 69f104c9959..b89822a080c 100644 --- a/source/blender/python/bmesh/bmesh_py_types_select.c +++ b/source/blender/python/bmesh/bmesh_py_types_select.c @@ -205,7 +205,6 @@ static PyObject *bpy_bmeditselseq_subscript_slice(BPy_BMEditSelSeq *self, Py_ssize_t stop) { int count = 0; - bool ok; PyObject *list; BMEditSelection *ese; @@ -214,30 +213,22 @@ static PyObject *bpy_bmeditselseq_subscript_slice(BPy_BMEditSelSeq *self, list = PyList_New(0); - ese = self->bm->selected.first; - - ok = (ese != NULL); - - if (UNLIKELY(ok == false)) { - return list; - } - - /* first loop up-until the start */ - for (ok = true; ok; ok = ((ese = ese->next) != NULL)) { + /* First loop up-until the start. */ + for (ese = self->bm->selected.first; ese; ese = ese->next) { if (count == start) { break; } count++; } - /* add items until stop */ - do { + /* Add items until stop. */ + for (; ese; ese = ese->next) { PyList_APPEND(list, BPy_BMElem_CreatePyObject(self->bm, &ese->ele->head)); count++; if (count == stop) { break; } - } while ((ese = ese->next)); + } return list; } -- cgit v1.2.3