[Bf-blender-cvs] SVN commit: /data/svn/bf-blender [51367] trunk/blender/source/blender/bmesh /intern: fix for free NULL pointer in BM_vert_splice() and BM_iter_as_arrayN() failed with BM_VERTS_OF_MESH/BM_EDGES_OF_MESH/ BM_FACES_OF_MESH.

[Campbell Barton]

Revision: 51367
          http://projects.blender.org/scm/viewvc.php?view=rev&root=bf-blender&revision=51367
Author:   campbellbarton
Date:     2012-10-16 14:35:37 +0000 (Tue, 16 Oct 2012)
Log Message:
-----------
fix for free NULL pointer in BM_vert_splice() and BM_iter_as_arrayN() failed with BM_VERTS_OF_MESH/BM_EDGES_OF_MESH/BM_FACES_OF_MESH.

Modified Paths:
--------------
    trunk/blender/source/blender/bmesh/intern/bmesh_core.c
    trunk/blender/source/blender/bmesh/intern/bmesh_iterators.c

Modified: trunk/blender/source/blender/bmesh/intern/bmesh_core.c
===================================================================
--- trunk/blender/source/blender/bmesh/intern/bmesh_core.c	2012-10-16 13:20:57 UTC (rev 51366)
+++ trunk/blender/source/blender/bmesh/intern/bmesh_core.c	2012-10-16 14:35:37 UTC (rev 51367)
@@ -1813,10 +1813,12 @@
 
 	/* we can't modify the vert while iterating so first allocate an array of loops */
 	loops = BM_iter_as_arrayN(bm, BM_LOOPS_OF_VERT, v, &loops_tot);
-	for (i = 0; i < loops_tot; i++) {
-		loops[i]->v = vtarget;
+	if (loops) {
+		for (i = 0; i < loops_tot; i++) {
+			loops[i]->v = vtarget;
+		}
+		MEM_freeN(loops);
 	}
-	MEM_freeN(loops);
 
 	/* move all the edges from v's disk to vtarget's disk */
 	while ((e = v->e)) {

Modified: trunk/blender/source/blender/bmesh/intern/bmesh_iterators.c
===================================================================
--- trunk/blender/source/blender/bmesh/intern/bmesh_iterators.c	2012-10-16 13:20:57 UTC (rev 51366)
+++ trunk/blender/source/blender/bmesh/intern/bmesh_iterators.c	2012-10-16 14:35:37 UTC (rev 51367)
@@ -120,6 +120,21 @@
 {
 	BMIter iter;
 
+	/* we can't rely on coun't being set */
+	switch (itype) {
+		case BM_VERTS_OF_MESH:
+			iter.count = bm->totvert;
+			break;
+		case BM_EDGES_OF_MESH:
+			iter.count = bm->totedge;
+			break;
+		case BM_FACES_OF_MESH:
+			iter.count = bm->totface;
+			break;
+		default:
+			break;
+	}
+
 	if (BM_iter_init(&iter, bm, itype, data) && iter.count > 0) {
 		BMElem *ele;
 		BMElem **array = MEM_mallocN(sizeof(ele) * iter.count, __func__);
@@ -229,6 +244,7 @@
 void  bmiter__edge_of_mesh_begin(BMIter *iter)
 {
 	BLI_mempool_iternew(iter->bm->epool, &iter->pooliter);
+	iter->count = iter->bm->totedge;  /* */
 }
 
 void  *bmiter__edge_of_mesh_step(BMIter *iter)