griefith/test
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Fix #104604: Potential crash when relinking node links

Browse Source 
In the first loop is safe to remove the current element.
The second loop can remove any element, potentially the next.
This triggers a read after freed.

Pull Request #104897
This commit is contained in:
Iliya Katueshenock
2023-02-17 21:23:35 +01:00
committed by Hans Goudey
parent 8b416f7f60
commit 2cd7e70c18
1 changed files with 7 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
source/blender/blenkernel/intern/node.cc
View File

@@ -2479,6 +2479,8 @@ void nodeInternalRelink(bNodeTree *ntree, bNode *node)
link.tosock->link = &link;
}
Vector<bNodeLink *> duplicate_links_to_remove;
/* redirect downstream links */
LISTBASE_FOREACH_MUTABLE (bNodeLink *, link, &ntree->links) {
/* do we have internal link? */
@@ -2495,7 +2497,7 @@ void nodeInternalRelink(bNodeTree *ntree, bNode *node)
link_to_compare->tosock == link->tosock) {
adjust_multi_input_indices_after_removed_link(
ntree, link_to_compare->tosock, link_to_compare->multi_input_socket_index);
nodeRemLink(ntree, link_to_compare);
duplicate_links_to_remove.append_non_duplicates(link_to_compare);
}
}
}
@@ -2533,6 +2535,10 @@ void nodeInternalRelink(bNodeTree *ntree, bNode *node)
}
}
for (bNodeLink *link : duplicate_links_to_remove) {
nodeRemLink(ntree, link);
}
/* remove remaining upstream links */
LISTBASE_FOREACH_MUTABLE (bNodeLink *, link, &ntree->links) {
if (link->tonode == node) {