[Bf-blender-cvs] [2c0ee61f6d3] master: Fix T51900: Crash after pressing "F" multiple times.

[Bastien Montagne]

Commit: 2c0ee61f6d3dc6baf8bb75d747c4fb1c2aca2f87
Author: Bastien Montagne
Date:   Wed Jun 28 10:53:52 2017 +0200
Branches: master
https://developer.blender.org/rB2c0ee61f6d3dc6baf8bb75d747c4fb1c2aca2f87

Fix T51900: Crash after pressing "F" multiple times.

`BMO_iter_as_array()` may fill less items than requested in given array,
so we have to update number of items to work on from its returned value,
otherwise code might try to use uninitialized memory.

===================================================================

M	source/blender/bmesh/operators/bmo_create.c

===================================================================

diff --git a/source/blender/bmesh/operators/bmo_create.c b/source/blender/bmesh/operators/bmo_create.c
index a980baf8626..20b8a481ede 100644
--- a/source/blender/bmesh/operators/bmo_create.c
+++ b/source/blender/bmesh/operators/bmo_create.c
@@ -74,13 +74,13 @@ void bmo_contextual_create_exec(BMesh *bm, BMOperator *op)
 		BMVert *verts[2];
 		BMEdge *e;
 
-		BMO_iter_as_array(op->slots_in, "geom", BM_VERT, (void **)verts, 2);
-
-		/* create edge */
-		e = BM_edge_create(bm, verts[0], verts[1], NULL, BM_CREATE_NO_DOUBLE);
-		BMO_edge_flag_enable(bm, e, ELE_OUT);
-		tote += 1;
-		BMO_slot_buffer_from_enabled_flag(bm, op, op->slots_out, "edges.out", BM_EDGE, ELE_OUT);
+		if (BMO_iter_as_array(op->slots_in, "geom", BM_VERT, (void **)verts, 2) == 0) {
+			/* create edge */
+			e = BM_edge_create(bm, verts[0], verts[1], NULL, BM_CREATE_NO_DOUBLE);
+			BMO_edge_flag_enable(bm, e, ELE_OUT);
+			tote += 1;
+			BMO_slot_buffer_from_enabled_flag(bm, op, op->slots_out, "edges.out", BM_EDGE, ELE_OUT);
+		}
 		return;
 	}
 
@@ -283,13 +283,13 @@ void bmo_contextual_create_exec(BMesh *bm, BMOperator *op)
 	 */
 	if (totv > 2) {
 		/* TODO, some of these vertes may be connected by edges,
-		 * this connectivity could be used rather then treating
+		 * this connectivity could be used rather than treating
 		 * them as a bunch of isolated verts. */
 
 		BMVert **vert_arr = MEM_mallocN(sizeof(BMVert *) * totv, __func__);
 		BMFace *f;
 
-		BMO_iter_as_array(op->slots_in, "geom", BM_VERT, (void **)vert_arr, totv);
+		totv = BMO_iter_as_array(op->slots_in, "geom", BM_VERT, (void **)vert_arr, totv);
 
 		BM_verts_sort_radial_plane(vert_arr, totv);