From d3b0977a354d91c363d7128f3e0ef2c5eea977e7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?K=C3=A9vin=20Dietrich?= Date: Sat, 29 Oct 2016 16:22:33 +0200 Subject: Fix T49878: Alembic crash with long object name Crash comes from writing to char array (ID::name) out its bound and thus overriding memory in the ID struct. --- source/blender/alembic/intern/abc_camera.cc | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) (limited to 'source/blender/alembic') diff --git a/source/blender/alembic/intern/abc_camera.cc b/source/blender/alembic/intern/abc_camera.cc index 5c34ec1391f..d5271e3ca31 100644 --- a/source/blender/alembic/intern/abc_camera.cc +++ b/source/blender/alembic/intern/abc_camera.cc @@ -119,7 +119,7 @@ bool AbcCameraReader::valid() const void AbcCameraReader::readObjectData(Main *bmain, float time) { - Camera *bcam = static_cast(BKE_camera_add(bmain, "abc_camera")); + Camera *bcam = static_cast(BKE_camera_add(bmain, m_data_name.c_str())); ISampleSelector sample_sel(time); CameraSample cam_sample; @@ -155,8 +155,6 @@ void AbcCameraReader::readObjectData(Main *bmain, float time) bcam->gpu_dof.focus_distance = cam_sample.getFocusDistance(); bcam->gpu_dof.fstop = cam_sample.getFStop(); - BLI_strncpy(bcam->id.name + 2, m_data_name.c_str(), m_data_name.size() + 1); - m_object = BKE_object_add_only_object(bmain, OB_CAMERA, m_object_name.c_str()); m_object->data = bcam; } -- cgit v1.2.3