Fix (unreported) invalid memory access in new 'newer blendfile version' code.

When choosing the new 'overwrite' option when trying to save a blendfile
from a newer version of Blender, it would cause invalid (use-after-free)
memory access.

Issue caused by the main commit (a1d7ec7139) of the new blendfile
compatibility handling. No idea how it was not detected earlier.

Many thanks to @weizhen for spotting the issue and doing some initial
investigation on it.
This commit is contained in:
Bastien Montagne
2023-08-22 17:26:37 +02:00
parent 6cfda322a6
commit b075c84ba3

View File

@@ -3830,12 +3830,16 @@ static void save_file_forwardcompat_cancel_button(uiBlock *block, wmGenericCallb
static void save_file_forwardcompat_overwrite(bContext *C, void *arg_block, void *arg_data)
{
wmWindow *win = CTX_wm_window(C);
UI_popup_block_close(C, win, static_cast<uiBlock *>(arg_block));
/* Re-use operator properties as defined for the initial 'save' operator, which triggered this
* 'forward compat' popup. */
wmGenericCallback *callback = WM_generic_callback_steal(
static_cast<wmGenericCallback *>(arg_data));
/* Needs to be done after stealing the callback data above, otherwise it would cause a
* use-after-free. */
UI_popup_block_close(C, win, static_cast<uiBlock *>(arg_block));
PointerRNA operator_propptr = {};
PointerRNA *operator_propptr_p = &operator_propptr;
IDProperty *operator_idproperties = static_cast<IDProperty *>(callback->user_data);