[Bf-blender-cvs] [ad2f210] wiggly-widgets: Fix memory header corruption, report and cause found by Julian, thanks!

[Antony Riakiotakis]

Commit: ad2f210413ad7aee347bb2824369b1425113d9e1
Author: Antony Riakiotakis
Date:   Sat Dec 5 19:34:04 2015 +0100
Branches: wiggly-widgets
https://developer.blender.org/rBad2f210413ad7aee347bb2824369b1425113d9e1

Fix memory header corruption, report and cause found by Julian, thanks!

===================================================================

M	source/blender/blenkernel/intern/cdderivedmesh.c
M	source/blender/blenkernel/intern/subsurf_ccg.c

===================================================================

diff --git a/source/blender/blenkernel/intern/cdderivedmesh.c b/source/blender/blenkernel/intern/cdderivedmesh.c
index 8e1544b..2cad0b8 100644
--- a/source/blender/blenkernel/intern/cdderivedmesh.c
+++ b/source/blender/blenkernel/intern/cdderivedmesh.c
@@ -1610,7 +1610,8 @@ static void cdDM_buffer_copy_facemap(DerivedMesh *dm, unsigned int *varray)
 	facemap_iter = facemap;
 	mp_iter = mp;
 	for (i = 0; i < totpoly; i++, facemap_iter++, mp_iter++) {
-		gdo->facemap_count[*facemap_iter] += ME_POLY_TRI_TOT(mp_iter);
+		if (*facemap_iter != -1)
+			gdo->facemap_count[*facemap_iter] += ME_POLY_TRI_TOT(mp_iter);
 	}
 
 	for (i = 0; i < gdo->totfacemaps; i++) {
@@ -1621,16 +1622,18 @@ static void cdDM_buffer_copy_facemap(DerivedMesh *dm, unsigned int *varray)
 	facemap_iter = facemap;
 	mp_iter = mp;
 	for (i = 0; i < totpoly; i++, facemap_iter++, mp_iter++) {
-		int numtri = ME_POLY_TRI_TOT(mp_iter);
-		int fmap_offset = (gdo->facemap_start[*facemap_iter] + facemap_offset[*facemap_iter]) * 3;
-		const MLoopTri *ltri_iter = ltri + poly_to_tri_count(i, mp_iter->loopstart);
+		if (*facemap_iter != -1) {
+			int numtri = ME_POLY_TRI_TOT(mp_iter);
+			int fmap_offset = (gdo->facemap_start[*facemap_iter] + facemap_offset[*facemap_iter]) * 3;
+			const MLoopTri *ltri_iter = ltri + poly_to_tri_count(i, mp_iter->loopstart);
 
-		facemap_offset[*facemap_iter] += numtri;
+			facemap_offset[*facemap_iter] += numtri;
 
-		for (; numtri > 0; numtri--, ltri_iter++) {
-			varray[fmap_offset++] = gdo->vert_points[mloop[ltri_iter->tri[0]].v].point_index;
-			varray[fmap_offset++] = gdo->vert_points[mloop[ltri_iter->tri[1]].v].point_index;
-			varray[fmap_offset++] = gdo->vert_points[mloop[ltri_iter->tri[2]].v].point_index;
+			for (; numtri > 0; numtri--, ltri_iter++) {
+				varray[fmap_offset++] = gdo->vert_points[mloop[ltri_iter->tri[0]].v].point_index;
+				varray[fmap_offset++] = gdo->vert_points[mloop[ltri_iter->tri[1]].v].point_index;
+				varray[fmap_offset++] = gdo->vert_points[mloop[ltri_iter->tri[2]].v].point_index;
+			}
 		}
 	}
 
diff --git a/source/blender/blenkernel/intern/subsurf_ccg.c b/source/blender/blenkernel/intern/subsurf_ccg.c
index 3303cc6..13ccc5d 100644
--- a/source/blender/blenkernel/intern/subsurf_ccg.c
+++ b/source/blender/blenkernel/intern/subsurf_ccg.c
@@ -2139,9 +2139,12 @@ static void ccgDM_buffer_copy_facemaps(DerivedMesh *dm, unsigned int *varray)
 	facemap_offset = MEM_callocN(gdo->totfacemaps * sizeof(*facemap_offset), "facemap_offset");
 
 	for (i = 0; i < totface; i++) {
-		CCGFace *f = ccgdm->faceMap[i].face;
-		int numVerts = ccgSubSurf_getFaceNumVerts(f);
-		gdo->facemap_count[facemap[ccgdm->faceMap[i].startFace]] += gridFaces * gridFaces * numVerts * 2;
+		int facemap_index = facemap[ccgdm->faceMap[i].startFace];
+		if (facemap_index != -1) {
+			CCGFace *f = ccgdm->faceMap[i].face;
+			int numVerts = ccgSubSurf_getFaceNumVerts(f);
+			gdo->facemap_count[facemap_index] += gridFaces * gridFaces * numVerts * 2;
+		}
 	}
 
 	for (i = 0; i < gdo->totfacemaps; i++) {
@@ -2150,25 +2153,27 @@ static void ccgDM_buffer_copy_facemaps(DerivedMesh *dm, unsigned int *varray)
 	}
 
 	for (i = 0; i < totface; i++) {
-		CCGFace *f = ccgdm->faceMap[i].face;
-		int S, x, y, numVerts = ccgSubSurf_getFaceNumVerts(f);
 		int facemap_index = facemap[ccgdm->faceMap[i].startFace];
-		int fmap_offset = (gdo->facemap_start[facemap_index] + facemap_offset[facemap_index]) * 3;
+		if (facemap_index != -1) {
+			CCGFace *f = ccgdm->faceMap[i].face;
+			int S, x, y, numVerts = ccgSubSurf_getFaceNumVerts(f);
+			int fmap_offset = (gdo->facemap_start[facemap_index] + facemap_offset[facemap_index]) * 3;
 
-		facemap_offset[facemap_index] += gridFaces * gridFaces * numVerts * 2;
+			facemap_offset[facemap_index] += gridFaces * gridFaces * numVerts * 2;
 
-		for (S = 0; S < numVerts; S++) {
-			for (y = 0; y < gridFaces; y++) {
-				for (x = 0; x < gridFaces; x++) {
-					varray[fmap_offset++] = totloops + 3;
-					varray[fmap_offset++] = totloops + 2;
-					varray[fmap_offset++] = totloops + 1;
+			for (S = 0; S < numVerts; S++) {
+				for (y = 0; y < gridFaces; y++) {
+					for (x = 0; x < gridFaces; x++) {
+						varray[fmap_offset++] = totloops + 3;
+						varray[fmap_offset++] = totloops + 2;
+						varray[fmap_offset++] = totloops + 1;
 
-					varray[fmap_offset++] = totloops + 3;
-					varray[fmap_offset++] = totloops + 1;
-					varray[fmap_offset++] = totloops;
+						varray[fmap_offset++] = totloops + 3;
+						varray[fmap_offset++] = totloops + 1;
+						varray[fmap_offset++] = totloops;
 
-					totloops += 4;
+						totloops += 4;
+					}
 				}
 			}
 		}