[Bf-blender-cvs] SVN commit: /data/svn/bf-blender [32221] trunk/blender/source/blender/ blenkernel/intern/customdata.c: Fix #23186: use of unitialized memory when creating new faces on a mesh

[Brecht Van Lommel]

Revision: 32221
          http://projects.blender.org/plugins/scmsvn/viewcvs.php?view=rev&root=bf-blender&revision=32221
Author:   blendix
Date:     2010-10-01 00:27:37 +0200 (Fri, 01 Oct 2010)

Log Message:
-----------
Fix #23186: use of unitialized memory when creating new faces on a mesh
with a multires modifier.

Modified Paths:
--------------
    trunk/blender/source/blender/blenkernel/intern/customdata.c

Modified: trunk/blender/source/blender/blenkernel/intern/customdata.c
===================================================================
--- trunk/blender/source/blender/blenkernel/intern/customdata.c	2010-09-30 21:07:42 UTC (rev 32220)
+++ trunk/blender/source/blender/blenkernel/intern/customdata.c	2010-09-30 22:27:37 UTC (rev 32221)
@@ -42,6 +42,7 @@
 
 #include "BLI_blenlib.h"
 #include "BLI_linklist.h"
+#include "BLI_math.h"
 #include "BLI_mempool.h"
 
 #include "BKE_customdata.h"
@@ -452,22 +453,27 @@
 	int corners, cornersize, S;
 
 	/* this function is untested .. */
-	corners = mdisp_corners(s);
-	cornersize = s->totdisp/corners;
+	if(s->disps) {
+		corners = mdisp_corners(s);
+		cornersize = s->totdisp/corners;
 
-	d = MEM_callocN(sizeof(float) * 3 * s->totdisp, "mdisps swap");
+		d = MEM_callocN(sizeof(float) * 3 * s->totdisp, "mdisps swap");
 
-	for(S = 0; S < corners; S++)
-		memcpy(d + cornersize*S, s->disps + cornersize*ci[S], cornersize*3*sizeof(float));
-	
-	if(s->disps)
-		MEM_freeN(s->disps);
-	s->disps = d;
+		for(S = 0; S < corners; S++)
+			memcpy(d + cornersize*S, s->disps + cornersize*ci[S], cornersize*3*sizeof(float));
+		
+		if(s->disps)
+			MEM_freeN(s->disps);
+		s->disps = d;
+	}
 }
 
 static void layerInterp_mdisps(void **sources, float *weights, float *sub_weights,
 				   int count, void *dest)
 {
+	MDisps *d = dest;
+	int i;
+
 	// XXX
 #if 0
 	MDisps *d = dest;
@@ -514,6 +520,11 @@
 			copy_v3_v3(d->disps[y * st + x], srcdisp);
 		}
 	}
+#else
+	if(d->disps) {
+		for(i = 0; i < d->totdisp; ++i)
+			zero_v3(d->disps[i]);
+	}
 #endif
 }