Fix #107420: crash getting PTCacheID when baking scene rigid body world

`ptcache_baker_create` falsely assumed the PointCache owner id is always
an **object**, but when baking rigid body world it is a **scene**. Code
would cast the ID to an object and passed that to `BKE_ptcache_id_find` /
`BKE_ptcache_ids_from_object` (which can get terribly wrong -- reading
_something_ on the scene as something from the assumed object).

Prior to f61ff22967 this was less likely to be a problem, but that
commit introduced a `DrawDataList` into the `struct Scene`. In the file
from the report, this would lead to `foreach_object_particle_ptcache`
now recognizing garbage memory as a particle system, accessing its
`ParticleSettings` `phystype` would then crash (buffer-overflow).

Now pass a NULL object to `BKE_ptcache_id_find` in case we are having a
scene, following code still handles rigid bodies just fine (the scene is
actually passed separately as well).

Pull Request: https://projects.blender.org/blender/blender/pulls/107536
This commit is contained in:
Philipp Oeser
2023-05-02 17:56:17 +02:00
committed by Philipp Oeser
parent 88d03d15c1
commit d0c6117196

View File

@@ -188,7 +188,8 @@ static PTCacheBaker *ptcache_baker_create(bContext *C, wmOperator *op, bool all)
if (!all) {
PointerRNA ptr = CTX_data_pointer_get_type(C, "point_cache", &RNA_PointCache);
Object *ob = (Object *)ptr.owner_id;
ID *id = ptr.owner_id;
Object *ob = (GS(id->name) == ID_OB) ? (Object *)id : NULL;
PointCache *cache = ptr.data;
baker->pid = BKE_ptcache_id_find(ob, baker->scene, cache);
}