[Bf-blender-cvs] SVN commit: /data/svn/bf-blender [45971] trunk/blender: fix for buffer overrun crash with saving scene name longer then 24 characters .

[Campbell Barton]

Revision: 45971
          http://projects.blender.org/scm/viewvc.php?view=rev&root=bf-blender&revision=45971
Author:   campbellbarton
Date:     2012-04-26 04:03:25 +0000 (Thu, 26 Apr 2012)
Log Message:
-----------
fix for buffer overrun crash with saving scene name longer then 24 characters.
writing render info would try write= 64 length string into 24 length buffer.

updated py script to extract render info too.

Modified Paths:
--------------
    trunk/blender/release/scripts/modules/blend_render_info.py
    trunk/blender/source/blender/blenloader/intern/writefile.c

Modified: trunk/blender/release/scripts/modules/blend_render_info.py
===================================================================
--- trunk/blender/release/scripts/modules/blend_render_info.py	2012-04-26 03:40:10 UTC (rev 45970)
+++ trunk/blender/release/scripts/modules/blend_render_info.py	2012-04-26 04:03:25 UTC (rev 45971)
@@ -75,7 +75,7 @@
         # Now we want the scene name, start and end frame. this is 32bites long
         start_frame, end_frame = struct.unpack('>2i' if is_big_endian else '<2i', blendfile.read(8))
 
-        scene_name = blendfile.read(24)
+        scene_name = blendfile.read(64)
 
         scene_name = scene_name[:scene_name.index(b'\0')]
 

Modified: trunk/blender/source/blender/blenloader/intern/writefile.c
===================================================================
--- trunk/blender/source/blender/blenloader/intern/writefile.c	2012-04-26 03:40:10 UTC (rev 45970)
+++ trunk/blender/source/blender/blenloader/intern/writefile.c	2012-04-26 04:03:25 UTC (rev 45971)
@@ -757,24 +757,30 @@
 	*screen= (window)? window->screen: NULL;
 }
 
+typedef struct RenderInfo {
+	int sfra;
+	int efra;
+	char scene_name[MAX_ID_NAME - 2];
+} RenderInfo;
+
 static void write_renderinfo(WriteData *wd, Main *mainvar)		/* for renderdeamon */
 {
 	bScreen *curscreen;
 	Scene *sce;
-	int data[8];
+	RenderInfo data;
 
 	/* XXX in future, handle multiple windows with multiple screnes? */
 	current_screen_compat(mainvar, &curscreen);
 
 	for (sce= mainvar->scene.first; sce; sce= sce->id.next) {
 		if (sce->id.lib==NULL  && ( sce==curscreen->scene || (sce->r.scemode & R_BG_RENDER)) ) {
-			data[0]= sce->r.sfra;
-			data[1]= sce->r.efra;
+			data.sfra = sce->r.sfra;
+			data.efra = sce->r.efra;
+			memset(data.scene_name, 0, sizeof(data.scene_name));
 
-			memset(data+2, 0, sizeof(int)*6);
-			BLI_strncpy((char *)(data+2), sce->id.name+2, sizeof(sce->id.name)-2);
+			BLI_strncpy(data.scene_name, sce->id.name + 2, sizeof(data.scene_name));
 
-			writedata(wd, REND, 32, data);
+			writedata(wd, REND, sizeof(data), &data);
 		}
 	}
 }