Fix (unreported) invalid memory access in new 'newer blendfile version' code.
When choosing the new 'overwrite' option when trying to save a blendfile
from a newer version of Blender, it would cause invalid (use-after-free)
memory access.
Issue caused by the main commit (a1d7ec7139) of the new blendfile
compatibility handling. No idea how it was not detected earlier.
Many thanks to @weizhen for spotting the issue and doing some initial
investigation on it.
This commit is contained in:
@@ -3830,12 +3830,16 @@ static void save_file_forwardcompat_cancel_button(uiBlock *block, wmGenericCallb
|
||||
static void save_file_forwardcompat_overwrite(bContext *C, void *arg_block, void *arg_data)
|
||||
{
|
||||
wmWindow *win = CTX_wm_window(C);
|
||||
UI_popup_block_close(C, win, static_cast<uiBlock *>(arg_block));
|
||||
|
||||
/* Re-use operator properties as defined for the initial 'save' operator, which triggered this
|
||||
* 'forward compat' popup. */
|
||||
wmGenericCallback *callback = WM_generic_callback_steal(
|
||||
static_cast<wmGenericCallback *>(arg_data));
|
||||
|
||||
/* Needs to be done after stealing the callback data above, otherwise it would cause a
|
||||
* use-after-free. */
|
||||
UI_popup_block_close(C, win, static_cast<uiBlock *>(arg_block));
|
||||
|
||||
PointerRNA operator_propptr = {};
|
||||
PointerRNA *operator_propptr_p = &operator_propptr;
|
||||
IDProperty *operator_idproperties = static_cast<IDProperty *>(callback->user_data);
|
||||
|
||||
Reference in New Issue
Block a user