From 4fc1a3c8b392d7819e89e0aafc1ecef558a37d4a Mon Sep 17 00:00:00 2001 From: Campbell Barton Date: Thu, 1 Nov 2012 09:56:18 +0000 Subject: fix for possible buffer overflow in gpu_nodes_get_vertex_attributes() and hair_velocity_smoothing() and a unlikely NULL pointer dereference in unlink_material_cb(). --- source/blender/gpu/intern/gpu_codegen.c | 23 +++++++++++++---------- 1 file changed, 13 insertions(+), 10 deletions(-) (limited to 'source/blender/gpu/intern/gpu_codegen.c') diff --git a/source/blender/gpu/intern/gpu_codegen.c b/source/blender/gpu/intern/gpu_codegen.c index b90e67ac838..b4490e656f3 100644 --- a/source/blender/gpu/intern/gpu_codegen.c +++ b/source/blender/gpu/intern/gpu_codegen.c @@ -1046,17 +1046,20 @@ static void gpu_nodes_get_vertex_attributes(ListBase *nodes, GPUVertexAttribs *a } } - if (a == attribs->totlayer && a < GPU_MAX_ATTRIB) { - input->attribid = attribs->totlayer++; - input->attribfirst = 1; - - attribs->layer[a].type = input->attribtype; - attribs->layer[a].attribid = input->attribid; - BLI_strncpy(attribs->layer[a].name, input->attribname, - sizeof(attribs->layer[a].name)); + if (a < GPU_MAX_ATTRIB) { + if (a == attribs->totlayer) { + input->attribid = attribs->totlayer++; + input->attribfirst = 1; + + attribs->layer[a].type = input->attribtype; + attribs->layer[a].attribid = input->attribid; + BLI_strncpy(attribs->layer[a].name, input->attribname, + sizeof(attribs->layer[a].name)); + } + else { + input->attribid = attribs->layer[a].attribid; + } } - else - input->attribid = attribs->layer[a].attribid; } } } -- cgit v1.2.3