[Bf-blender-cvs] [41a3ce8] mathutils_bvhtree: Check range of triangles passed into new bvhtrees

[Campbell Barton]

Commit: 41a3ce878caaefba7737ba0e203116954cfdbb90
Author: Campbell Barton
Date:   Thu Jul 16 03:00:44 2015 +1000
Branches: mathutils_bvhtree
https://developer.blender.org/rB41a3ce878caaefba7737ba0e203116954cfdbb90

Check range of triangles passed into new bvhtrees

Avoid crashesing on invalid data

===================================================================

M	source/blender/python/mathutils/mathutils_bvhtree.c

===================================================================

diff --git a/source/blender/python/mathutils/mathutils_bvhtree.c b/source/blender/python/mathutils/mathutils_bvhtree.c
index c1086dc..470f0fd 100644
--- a/source/blender/python/mathutils/mathutils_bvhtree.c
+++ b/source/blender/python/mathutils/mathutils_bvhtree.c
@@ -811,6 +811,7 @@ static int PyBVHTreeCustom__tp_init(PyBVHTree_Custom *self, PyObject *args, PyOb
 		for (i = 0; i < numtris; i++) {
 			PyObject *py_triverts = PySequence_Fast_GET_ITEM(py_tris_fast, i);
 			PyObject *py_triverts_fast = PySequence_Fast(py_triverts, error_prefix);
+			int j;
 
 			if (py_triverts_fast == NULL) {
 				valid = false;
@@ -825,9 +826,21 @@ static int PyBVHTreeCustom__tp_init(PyBVHTree_Custom *self, PyObject *args, PyOb
 				break;
 			}
 			
-			tp->tri[0] = _PyLong_AsInt(PySequence_Fast_GET_ITEM(py_triverts_fast, 0));
-			tp->tri[1] = _PyLong_AsInt(PySequence_Fast_GET_ITEM(py_triverts_fast, 1));
-			tp->tri[2] = _PyLong_AsInt(PySequence_Fast_GET_ITEM(py_triverts_fast, 2));
+			for (j = 0; j++; j < 3) {
+				const int index = _PyLong_AsInt(PySequence_Fast_GET_ITEM(py_triverts_fast, j));
+				if (UNLIKELY(index == -1 && PyErr_Occurred())) {
+					valid = false;
+					break;
+				}
+				else if (UNLIKELY(index < 0 || index >= numverts)) {
+					PyErr_Format(PyExc_ValueError,
+					             "Index %d out of range [0-%d]", index, numverts);
+					valid = false;
+					break;
+				}
+
+				tp->tri[j] = index;
+			}
 			Py_DECREF(py_triverts_fast);
 		}
 	}