[Bf-blender-cvs] SVN commit: /data/svn/bf-blender [57801] trunk/blender/source/blender/ python/intern/bpy_rna_array.c: fix for python api bug: assigning the wrong size array to an RNA property wasn' t checking the length and could crash, eg:

Campbell Barton ideasman42 at gmail.com
Thu Jun 27 03:01:12 CEST 2013


Revision: 57801
          http://projects.blender.org/scm/viewvc.php?view=rev&root=bf-blender&revision=57801
Author:   campbellbarton
Date:     2013-06-27 01:01:11 +0000 (Thu, 27 Jun 2013)
Log Message:
-----------
fix for python api bug: assigning the wrong size array to an RNA property wasn't checking the length and could crash, eg:
  mesh.polygons[0].vertices = (10,)

Modified Paths:
--------------
    trunk/blender/source/blender/python/intern/bpy_rna_array.c

Modified: trunk/blender/source/blender/python/intern/bpy_rna_array.c
===================================================================
--- trunk/blender/source/blender/python/intern/bpy_rna_array.c	2013-06-27 00:37:42 UTC (rev 57800)
+++ trunk/blender/source/blender/python/intern/bpy_rna_array.c	2013-06-27 01:01:11 UTC (rev 57801)
@@ -74,13 +74,14 @@
 	/* not the last dimension */
 	if (dim + 1 < totdim) {
 		/* check that a sequence contains dimsize[dim] items */
-		const Py_ssize_t seq_size = PySequence_Size(seq);
+		const int seq_size = PySequence_Size(seq);
 		if (seq_size == -1) {
 			PyErr_Format(PyExc_ValueError, "%s sequence expected at dimension %d, not '%s'",
 			             error_prefix, dim + 1, Py_TYPE(seq)->tp_name);
 			return -1;
 		}
 		for (i = 0; i < seq_size; i++) {
+			Py_ssize_t item_seq_size;
 			PyObject *item;
 			int ok = 1;
 			item = PySequence_GetItem(seq, i);
@@ -90,7 +91,7 @@
 				             error_prefix, Py_TYPE(seq)->tp_name, i);
 				ok = 0;
 			}
-			else if (!PySequence_Check(item)) {
+			else if ((item_seq_size = PySequence_Size(item)) == -1) {
 				/* BLI_snprintf(error_str, error_str_size, "expected a sequence of %s", item_type_str); */
 				PyErr_Format(PyExc_TypeError, "%s expected a sequence of %s, not %s",
 				             error_prefix, item_type_str, Py_TYPE(item)->tp_name);
@@ -101,12 +102,12 @@
 			 * dimsize[2] = 5
 			 *
 			 * dim = 0 */
-			else if (PySequence_Size(item) != dimsize[dim + 1]) {
+			else if (item_seq_size != dimsize[dim + 1]) {
 				/* BLI_snprintf(error_str, error_str_size,
 				 *              "sequences of dimension %d should contain %d items",
 				 *              dim + 1, dimsize[dim + 1]); */
-				PyErr_Format(PyExc_ValueError, "%s sequences of dimension %d should contain %d items",
-				             error_prefix, dim + 1, dimsize[dim + 1]);
+				PyErr_Format(PyExc_ValueError, "%s sequences of dimension %d should contain %d items, not %d",
+				             error_prefix, dim + 1, dimsize[dim + 1], item_seq_size);
 				ok = 0;
 			}
 			else if (validate_array_type(item, dim + 1, totdim, dimsize, check_item_type, item_type_str, error_prefix) == -1) {
@@ -128,6 +129,12 @@
 			             error_prefix, dim + 1, Py_TYPE(seq)->tp_name);
 			return -1;
 		}
+		else if (seq_size != dimsize[dim]) {
+			PyErr_Format(PyExc_ValueError, "%s sequences of dimension %d should contain %d items, not %d",
+			             error_prefix, dim, dimsize[dim], seq_size);
+			return -1;
+		}
+
 		for (i = 0; i < seq_size; i++) {
 			PyObject *item = PySequence_GetItem(seq, i);
 




More information about the Bf-blender-cvs mailing list