From 2089a17f7e69bb2106950b041486e23928065fb0 Mon Sep 17 00:00:00 2001 From: Luca Rood Date: Sat, 4 Mar 2017 03:16:50 -0300 Subject: Fix T50838: Surface Deform DM use after free issue Implementd fix suggested by @sergey in T50838. --- source/blender/modifiers/intern/MOD_surfacedeform.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) (limited to 'source/blender/modifiers') diff --git a/source/blender/modifiers/intern/MOD_surfacedeform.c b/source/blender/modifiers/intern/MOD_surfacedeform.c index 5e852e84516..3beb69f0790 100644 --- a/source/blender/modifiers/intern/MOD_surfacedeform.c +++ b/source/blender/modifiers/intern/MOD_surfacedeform.c @@ -1088,6 +1088,7 @@ static void surfacedeformModifier_do(ModifierData *md, float (*vertexCos)[3], un SurfaceDeformModifierData *smd = (SurfaceDeformModifierData *)md; DerivedMesh *tdm; unsigned int tnumpoly; + bool tdm_vert_alloc; /* Exit function if bind flag is not set (free bind data if any) */ if (!(smd->flags & MOD_SDEF_BIND)) { @@ -1128,12 +1129,16 @@ static void surfacedeformModifier_do(ModifierData *md, float (*vertexCos)[3], un /* Actual vertex location update starts here */ SDefDeformData data = {.bind_verts = smd->verts, - .mvert = tdm->getVertArray(tdm), + .mvert = DM_get_vert_array(tdm, &tdm_vert_alloc), .vertexCos = vertexCos}; BLI_task_parallel_range_ex(0, numverts, &data, NULL, 0, deformVert, numverts > 10000, false); + if (tdm_vert_alloc) { + MEM_freeN((void *)data.mvert); + } + tdm->release(tdm); } -- cgit v1.2.3