From 248e3d74a0382dcdf5baf19336ed97e98220fafc Mon Sep 17 00:00:00 2001
From: Tamito Kajiyama <rd6t-kjym@asahi-net.or.jp>
Date: Sat, 24 Aug 2013 11:42:00 +0000
Subject: Fix for [#36374] Read unitialized memory in Freestyle. A variable
 keeping a bounding box was referenced after it was flagged as empty.

---
 source/blender/freestyle/intern/application/Controller.cpp | 7 +++++--
 source/blender/freestyle/intern/application/Controller.h   | 1 +
 source/blender/freestyle/intern/geometry/BBox.h            | 4 ++++
 3 files changed, 10 insertions(+), 2 deletions(-)

(limited to 'source/blender/freestyle')

diff --git a/source/blender/freestyle/intern/application/Controller.cpp b/source/blender/freestyle/intern/application/Controller.cpp
index dbf3fa8349e..c61f72295d2 100644
--- a/source/blender/freestyle/intern/application/Controller.cpp
+++ b/source/blender/freestyle/intern/application/Controller.cpp
@@ -290,6 +290,8 @@ int Controller::LoadMesh(Render *re, SceneRenderLayer *srl)
 
 	_ListOfModels.push_back("Blender_models");
 
+	_Scene3dBBox = _RootNode->bbox();
+
 	_bboxDiag = (_RootNode->bbox().getMax() - _RootNode->bbox().getMin()).norm();
 	if (G.debug & G_DEBUG_FREESTYLE) {
 		cout << "Triangles nb     : " << _SceneNumFaces << endl;
@@ -339,6 +341,7 @@ void Controller::DeleteWingedEdge()
 
 	// clears the grid
 	_Grid.clear();
+	_Scene3dBBox.clear();
 	_SceneNumFaces = 0;
 	_minEdgeSize = DBL_MAX;
 }
@@ -540,8 +543,8 @@ void Controller::ComputeViewMap()
 	}
 	_Chrono.start();
 	// Build View Map
-	_ViewMap = vmBuilder.BuildViewMap(*_winged_edge, _VisibilityAlgo, _EPSILON, _RootNode->bbox(), _SceneNumFaces);
-	_ViewMap->setScene3dBBox(_RootNode->bbox());
+	_ViewMap = vmBuilder.BuildViewMap(*_winged_edge, _VisibilityAlgo, _EPSILON, _Scene3dBBox, _SceneNumFaces);
+	_ViewMap->setScene3dBBox(_Scene3dBBox);
 
 	if (G.debug & G_DEBUG_FREESTYLE) {
 		printf("ViewMap edge count : %i\n", _ViewMap->viewedges_size());
diff --git a/source/blender/freestyle/intern/application/Controller.h b/source/blender/freestyle/intern/application/Controller.h
index d4537f5f987..f5e50347d0f 100644
--- a/source/blender/freestyle/intern/application/Controller.h
+++ b/source/blender/freestyle/intern/application/Controller.h
@@ -211,6 +211,7 @@ private:
 	FastGrid _Grid;
 	//HashGrid _Grid;
 
+	BBox<Vec3r> _Scene3dBBox;
 	unsigned int _SceneNumFaces;
 	real _minEdgeSize;
 	real _EPSILON;
diff --git a/source/blender/freestyle/intern/geometry/BBox.h b/source/blender/freestyle/intern/geometry/BBox.h
index 794ceba48e7..afff36dec7b 100644
--- a/source/blender/freestyle/intern/geometry/BBox.h
+++ b/source/blender/freestyle/intern/geometry/BBox.h
@@ -28,6 +28,8 @@
  *  \date 22/05/2003
  */
 
+#include "BLI_utildefines.h"
+
 #ifdef WITH_CXX_GUARDEDALLOC
 #include "MEM_guardedalloc.h"
 #endif
@@ -95,6 +97,7 @@ public:
 
 	inline BBox<Point>& operator=(const BBox<Point>& b)
 	{
+		BLI_assert(!b.empty());
 		_min = b.getMin();
 		_max = b.getMax();
 		_empty = false;
@@ -103,6 +106,7 @@ public:
 
 	inline BBox<Point>& operator+=(const BBox<Point>& b)
 	{
+		BLI_assert(!b.empty());
 		if (_empty) {
 			_min = b.getMin();
 			_max = b.getMax();
-- 
cgit v1.2.3