From 2c0ee61f6d3dc6baf8bb75d747c4fb1c2aca2f87 Mon Sep 17 00:00:00 2001 From: Bastien Montagne Date: Wed, 28 Jun 2017 10:53:52 +0200 Subject: Fix T51900: Crash after pressing "F" multiple times. `BMO_iter_as_array()` may fill less items than requested in given array, so we have to update number of items to work on from its returned value, otherwise code might try to use uninitialized memory. --- source/blender/bmesh/operators/bmo_create.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) (limited to 'source/blender/bmesh') diff --git a/source/blender/bmesh/operators/bmo_create.c b/source/blender/bmesh/operators/bmo_create.c index a980baf8626..20b8a481ede 100644 --- a/source/blender/bmesh/operators/bmo_create.c +++ b/source/blender/bmesh/operators/bmo_create.c @@ -74,13 +74,13 @@ void bmo_contextual_create_exec(BMesh *bm, BMOperator *op) BMVert *verts[2]; BMEdge *e; - BMO_iter_as_array(op->slots_in, "geom", BM_VERT, (void **)verts, 2); - - /* create edge */ - e = BM_edge_create(bm, verts[0], verts[1], NULL, BM_CREATE_NO_DOUBLE); - BMO_edge_flag_enable(bm, e, ELE_OUT); - tote += 1; - BMO_slot_buffer_from_enabled_flag(bm, op, op->slots_out, "edges.out", BM_EDGE, ELE_OUT); + if (BMO_iter_as_array(op->slots_in, "geom", BM_VERT, (void **)verts, 2) == 0) { + /* create edge */ + e = BM_edge_create(bm, verts[0], verts[1], NULL, BM_CREATE_NO_DOUBLE); + BMO_edge_flag_enable(bm, e, ELE_OUT); + tote += 1; + BMO_slot_buffer_from_enabled_flag(bm, op, op->slots_out, "edges.out", BM_EDGE, ELE_OUT); + } return; } @@ -283,13 +283,13 @@ void bmo_contextual_create_exec(BMesh *bm, BMOperator *op) */ if (totv > 2) { /* TODO, some of these vertes may be connected by edges, - * this connectivity could be used rather then treating + * this connectivity could be used rather than treating * them as a bunch of isolated verts. */ BMVert **vert_arr = MEM_mallocN(sizeof(BMVert *) * totv, __func__); BMFace *f; - BMO_iter_as_array(op->slots_in, "geom", BM_VERT, (void **)vert_arr, totv); + totv = BMO_iter_as_array(op->slots_in, "geom", BM_VERT, (void **)vert_arr, totv); BM_verts_sort_radial_plane(vert_arr, totv); -- cgit v1.2.3