From f24854005d8688fb86cf41bd62a63580c63f818d Mon Sep 17 00:00:00 2001 From: Campbell Barton Date: Fri, 7 Jan 2022 16:32:01 +1100 Subject: Fix T94708: negative reference count error with Python API callbacks Regression in 7972785d7b90771f50534fe3e1101d8adb615fa3 that caused Python callback arguments to be de-referenced twice - potentially accessing freed memory. Making a new-file with a circle-select tool active triggered this (for example). Now arguments aren't de-referenced when Blender it's self has already removed the callback handle. --- source/blender/editors/space_api/spacetypes.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) (limited to 'source/blender/editors/space_api') diff --git a/source/blender/editors/space_api/spacetypes.c b/source/blender/editors/space_api/spacetypes.c index 93d023c8bb4..f8adba30547 100644 --- a/source/blender/editors/space_api/spacetypes.c +++ b/source/blender/editors/space_api/spacetypes.c @@ -248,15 +248,16 @@ void *ED_region_draw_cb_activate(ARegionType *art, return rdc; } -void ED_region_draw_cb_exit(ARegionType *art, void *handle) +bool ED_region_draw_cb_exit(ARegionType *art, void *handle) { LISTBASE_FOREACH (RegionDrawCB *, rdc, &art->drawcalls) { if (rdc == (RegionDrawCB *)handle) { BLI_remlink(&art->drawcalls, rdc); MEM_freeN(rdc); - return; + return true; } } + return false; } static void ed_region_draw_cb_draw(const bContext *C, ARegion *region, ARegionType *art, int type) -- cgit v1.2.3