From bc627fbf657e6b35116505f185197d170203552e Mon Sep 17 00:00:00 2001 From: Campbell Barton Date: Thu, 29 Jul 2021 14:09:30 +1000 Subject: Fix gpu.types.GPUTexture crash when the size argument was too big Missing length check on the size argument before copying it into a fixed size buffer. --- source/blender/python/gpu/gpu_py_texture.c | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'source') diff --git a/source/blender/python/gpu/gpu_py_texture.c b/source/blender/python/gpu/gpu_py_texture.c index 257c6d773eb..48802ab9407 100644 --- a/source/blender/python/gpu/gpu_py_texture.c +++ b/source/blender/python/gpu/gpu_py_texture.c @@ -153,6 +153,12 @@ static PyObject *pygpu_texture__tp_new(PyTypeObject *UNUSED(self), PyObject *arg int len = 1; if (PySequence_Check(py_size)) { len = PySequence_Size(py_size); + if ((len < 1) || (len > 3)) { + PyErr_Format(PyExc_ValueError, + "GPUTexture.__new__: \"size\" must be between 1 and 3 in length (got %d)", + len); + return NULL; + } if (PyC_AsArray(size, py_size, len, &PyLong_Type, false, "GPUTexture.__new__") == -1) { return NULL; } -- cgit v1.2.3