From a151b46627f32aeb39553994b84133a77ac2b036 Mon Sep 17 00:00:00 2001 From: Campbell Barton Date: Sun, 19 Nov 2017 16:45:27 +1100 Subject: Fix T53347: Vertex paint crash on undo/exit --- source/blender/blenkernel/intern/subsurf_ccg.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) (limited to 'source/blender/blenkernel/intern/subsurf_ccg.c') diff --git a/source/blender/blenkernel/intern/subsurf_ccg.c b/source/blender/blenkernel/intern/subsurf_ccg.c index 0cdc97c829f..f8025f8df84 100644 --- a/source/blender/blenkernel/intern/subsurf_ccg.c +++ b/source/blender/blenkernel/intern/subsurf_ccg.c @@ -4031,10 +4031,12 @@ static void ccgDM_release(DerivedMesh *dm) if (ccgdm->gridOffset) MEM_freeN(ccgdm->gridOffset); if (ccgdm->gridFlagMats) MEM_freeN(ccgdm->gridFlagMats); if (ccgdm->gridHidden) { - int i, numGrids = dm->getNumGrids(dm); - for (i = 0; i < numGrids; i++) { - if (ccgdm->gridHidden[i]) + /* Using dm->getNumGrids(dm) accesses freed memory */ + uint numGrids = ccgdm->numGrid; + for (uint i = 0; i < numGrids; i++) { + if (ccgdm->gridHidden[i]) { MEM_freeN(ccgdm->gridHidden[i]); + } } MEM_freeN(ccgdm->gridHidden); } @@ -4338,6 +4340,7 @@ static void ccgdm_create_grids(DerivedMesh *dm) ccgdm->gridFaces = gridFaces; ccgdm->gridOffset = gridOffset; ccgdm->gridFlagMats = gridFlagMats; + ccgdm->numGrid = numGrids; } static CCGElem **ccgDM_getGridData(DerivedMesh *dm) -- cgit v1.2.3