griefith/test2
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Fix buffer overflow reading the selection buffer

Browse Source 
Reading from the top-right of the selection buffer could read
past the buffer bounds. Resolve by ensuring the clamped buffer
isn't empty. Relates to #141591.
This commit is contained in:
Campbell Barton
2025-07-08 15:35:06 +10:00
parent a5f915d3d3
commit 20ee5c2283
2 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
source/blender/draw/intern/draw_select_buffer.cc
View File

@@ -80,7 +80,7 @@ uint *DRW_select_buffer_read(
/* Make sure that the rect is within the bounds of the viewport.
* Some GPUs have problems reading pixels off limits. */
rcti rect_clamp = *rect;
if (BLI_rcti_isect(&r, &rect_clamp, &rect_clamp)) {
if (BLI_rcti_isect(&r, &rect_clamp, &rect_clamp) && !BLI_rcti_is_empty(&rect_clamp)) {
SELECTID_Context *select_ctx = DRW_select_engine_context_get();
RegionView3D *rv3d = static_cast<RegionView3D *>(region->regiondata);

2
source/blender/gpu/intern/gpu_select.cc
View File

@@ -287,6 +287,8 @@ void GPU_select_buffer_stride_realign(const rcti *src, const rcti *dst, uint *r_
const int dst_x = BLI_rcti_size_x(dst);
const int dst_y = BLI_rcti_size_y(dst);
BLI_assert(dst_x > 0 && dst_y > 0);
int last_px_id = src_x * (y + dst_y - 1) + (x + dst_x - 1);
memset(&r_buf[last_px_id + 1], 0, (src_x * src_y - (last_px_id + 1)) * sizeof(*r_buf));