[Bf-blender-cvs] [5680172] master: Fix for out of bounds read calculating spline mapping

[Campbell Barton]

Commit: 5680172a3a2525677e2fcd506db0cf10ebd04393
Author: Campbell Barton
Date:   Mon May 26 21:57:53 2014 +1000
https://developer.blender.org/rB5680172a3a2525677e2fcd506db0cf10ebd04393

Fix for out of bounds read calculating spline mapping

===================================================================

M	source/blender/blenkernel/intern/displist.c

===================================================================

diff --git a/source/blender/blenkernel/intern/displist.c b/source/blender/blenkernel/intern/displist.c
index 822e4b9..c5f1a0b 100644
--- a/source/blender/blenkernel/intern/displist.c
+++ b/source/blender/blenkernel/intern/displist.c
@@ -1365,16 +1365,22 @@ static void fillBevelCap(Nurb *nu, DispList *dlb, float *prev_fp, ListBase *disp
 static void calc_bevfac_spline_mapping(BevList *bl, float bevfac, float spline_length, const float *bevp_array,
                                        int *r_bev, float *r_blend)
 {
+	const float len_target = bevfac * spline_length;
 	float len = 0.0f;
+	float len_step = 0.0f;
 	int i;
-	for (i = 0; i < bl->nr; i++) {
-		*r_bev = i;
-		*r_blend = (bevfac * spline_length - len) / bevp_array[i];
-		if (len + bevp_array[i] > bevfac * spline_length) {
+	for (i = 0; i < bl->nr - 1; i++) {
+		float len_next;
+		len_step = bevp_array[i];
+		len_next = len + len_step;
+		if (len_next > len_target) {
 			break;
 		}
-		len += bevp_array[i];
+		len = len_next;
 	}
+
+	*r_bev = i;
+	*r_blend = (len_target - len) / len_step;
 }
 
 static void calc_bevfac_mapping_default(