From 5680172a3a2525677e2fcd506db0cf10ebd04393 Mon Sep 17 00:00:00 2001 From: Campbell Barton Date: Mon, 26 May 2014 21:57:53 +1000 Subject: Fix for out of bounds read calculating spline mapping --- source/blender/blenkernel/intern/displist.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) (limited to 'source/blender/blenkernel/intern/displist.c') diff --git a/source/blender/blenkernel/intern/displist.c b/source/blender/blenkernel/intern/displist.c index 822e4b90f22..c5f1a0b018a 100644 --- a/source/blender/blenkernel/intern/displist.c +++ b/source/blender/blenkernel/intern/displist.c @@ -1365,16 +1365,22 @@ static void fillBevelCap(Nurb *nu, DispList *dlb, float *prev_fp, ListBase *disp static void calc_bevfac_spline_mapping(BevList *bl, float bevfac, float spline_length, const float *bevp_array, int *r_bev, float *r_blend) { + const float len_target = bevfac * spline_length; float len = 0.0f; + float len_step = 0.0f; int i; - for (i = 0; i < bl->nr; i++) { - *r_bev = i; - *r_blend = (bevfac * spline_length - len) / bevp_array[i]; - if (len + bevp_array[i] > bevfac * spline_length) { + for (i = 0; i < bl->nr - 1; i++) { + float len_next; + len_step = bevp_array[i]; + len_next = len + len_step; + if (len_next > len_target) { break; } - len += bevp_array[i]; + len = len_next; } + + *r_bev = i; + *r_blend = (len_target - len) / len_step; } static void calc_bevfac_mapping_default( -- cgit v1.2.3