From b6c07d69e2f022f024c6ec2ff92925dbc6bbd79e Mon Sep 17 00:00:00 2001
From: Germano Cavalcante <mano-wii>
Date: Mon, 8 Mar 2021 10:29:57 -0300
Subject: Fix T86106: bpy.types.SpaceView3D.draw_handler_remove(...) causes
 Blender to crash

The handle of a drawing callback can be removed within the drawing function itself.

This causes `var = (type)(((Link *)(var))->next` to read an invalid memory value in C.
---
 source/blender/windowmanager/intern/wm_draw.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'source/blender/windowmanager/intern')

diff --git a/source/blender/windowmanager/intern/wm_draw.c b/source/blender/windowmanager/intern/wm_draw.c
index 071bce822a5..e0c4ab8eaf3 100644
--- a/source/blender/windowmanager/intern/wm_draw.c
+++ b/source/blender/windowmanager/intern/wm_draw.c
@@ -98,7 +98,7 @@ static void wm_paintcursor_draw(bContext *C, ScrArea *area, ARegion *region)
     return;
   }
 
-  LISTBASE_FOREACH (wmPaintCursor *, pc, &wm->paintcursors) {
+  LISTBASE_FOREACH_MUTABLE (wmPaintCursor *, pc, &wm->paintcursors) {
     if ((pc->space_type != SPACE_TYPE_ANY) && (area->spacetype != pc->space_type)) {
       continue;
     }
-- 
cgit v1.2.3