Fix #107420: crash getting PTCacheID when baking scene rigid body world
`ptcache_baker_create` falsely assumed the PointCache owner id is always
an **object**, but when baking rigid body world it is a **scene**. Code
would cast the ID to an object and passed that to `BKE_ptcache_id_find` /
`BKE_ptcache_ids_from_object` (which can get terribly wrong -- reading
_something_ on the scene as something from the assumed object).
Prior to f61ff22967 this was less likely to be a problem, but that
commit introduced a `DrawDataList` into the `struct Scene`. In the file
from the report, this would lead to `foreach_object_particle_ptcache`
now recognizing garbage memory as a particle system, accessing its
`ParticleSettings` `phystype` would then crash (buffer-overflow).
Now pass a NULL object to `BKE_ptcache_id_find` in case we are having a
scene, following code still handles rigid bodies just fine (the scene is
actually passed separately as well).
Pull Request: https://projects.blender.org/blender/blender/pulls/107536
This commit is contained in:
committed by
Philipp Oeser
parent
88d03d15c1
commit
d0c6117196
@@ -188,7 +188,8 @@ static PTCacheBaker *ptcache_baker_create(bContext *C, wmOperator *op, bool all)
|
||||
|
||||
if (!all) {
|
||||
PointerRNA ptr = CTX_data_pointer_get_type(C, "point_cache", &RNA_PointCache);
|
||||
Object *ob = (Object *)ptr.owner_id;
|
||||
ID *id = ptr.owner_id;
|
||||
Object *ob = (GS(id->name) == ID_OB) ? (Object *)id : NULL;
|
||||
PointCache *cache = ptr.data;
|
||||
baker->pid = BKE_ptcache_id_find(ob, baker->scene, cache);
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user