From b6a803fb368953bca1a7480694a7ab6d97439fad Mon Sep 17 00:00:00 2001 From: Campbell Barton Date: Sat, 6 Oct 2012 12:00:54 +0000 Subject: fix reading past array bounds for nearest_uv_between() and draw_tracking_tracks(). --- source/blender/editors/space_clip/clip_draw.c | 2 +- source/blender/editors/uvedit/uvedit_ops.c | 9 ++++----- 2 files changed, 5 insertions(+), 6 deletions(-) (limited to 'source/blender') diff --git a/source/blender/editors/space_clip/clip_draw.c b/source/blender/editors/space_clip/clip_draw.c index b22c9a60bdc..5e940df2a30 100644 --- a/source/blender/editors/space_clip/clip_draw.c +++ b/source/blender/editors/space_clip/clip_draw.c @@ -1126,7 +1126,7 @@ static void draw_tracking_tracks(SpaceClip *sc, ARegion *ar, MovieClip *clip, if (MARKER_VISIBLE(sc, track, marker)) { float npos[2]; - copy_v4_v4(vec, track->bundle_pos); + copy_v3_v3(vec, track->bundle_pos); vec[3] = 1; mul_v4_m4v4(pos, mat, vec); diff --git a/source/blender/editors/uvedit/uvedit_ops.c b/source/blender/editors/uvedit/uvedit_ops.c index f732808fa59..6e655faf35f 100644 --- a/source/blender/editors/uvedit/uvedit_ops.c +++ b/source/blender/editors/uvedit/uvedit_ops.c @@ -759,14 +759,13 @@ static int nearest_uv_between(BMEditMesh *em, BMFace *efa, int UNUSED(nverts), i BMLoop *l; MLoopUV *luv; BMIter iter; - float m[3], v1[3], v2[3], c1, c2, *uv1 = NULL, /* *uv2, */ /* UNUSED */ *uv3 = NULL; + float m[2], v1[2], v2[2], c1, c2, *uv1 = NULL, /* *uv2, */ /* UNUSED */ *uv3 = NULL; int id1, id2, i; id1 = (id + efa->len - 1) % efa->len; id2 = (id + efa->len + 1) % efa->len; - m[0] = co[0] - uv[0]; - m[1] = co[1] - uv[1]; + sub_v2_v2v2(m, co, uv); i = 0; BM_ITER_ELEM (l, &iter, efa, BM_LOOPS_OF_FACE) { @@ -782,8 +781,8 @@ static int nearest_uv_between(BMEditMesh *em, BMFace *efa, int UNUSED(nverts), i i++; } - sub_v3_v3v3(v1, uv1, uv); - sub_v3_v3v3(v2, uv3, uv); + sub_v2_v2v2(v1, uv1, uv); + sub_v2_v2v2(v2, uv3, uv); /* m and v2 on same side of v-v1? */ c1 = v1[0] * m[1] - v1[1] * m[0]; -- cgit v1.2.3