[Bf-blender-cvs] [bddd9d809d2] master: Fix integer overflows in meshcache modifier.

[lazydodo]

Commit: bddd9d809d2c291eb0a92220195908c51ae2ce80
Author: lazydodo
Date:   Fri May 26 06:26:21 2017 -0600
Branches: master
https://developer.blender.org/rBbddd9d809d2c291eb0a92220195908c51ae2ce80

Fix integer overflows in meshcache modifier.

Differential Revision: https://developer.blender.org/D2688

===================================================================

M	source/blender/modifiers/intern/MOD_meshcache_mdd.c
M	source/blender/modifiers/intern/MOD_meshcache_pc2.c

===================================================================

diff --git a/source/blender/modifiers/intern/MOD_meshcache_mdd.c b/source/blender/modifiers/intern/MOD_meshcache_mdd.c
index 90fc750de3b..3dd3a5fc598 100644
--- a/source/blender/modifiers/intern/MOD_meshcache_mdd.c
+++ b/source/blender/modifiers/intern/MOD_meshcache_mdd.c
@@ -35,6 +35,9 @@
 #ifdef __LITTLE_ENDIAN__
 #  include "BLI_endian_switch.h"
 #endif
+#ifdef WIN32
+#  include "BLI_winstuff.h"
+#endif
 
 #include "MOD_meshcache_util.h"  /* own include */
 
@@ -157,7 +160,7 @@ bool MOD_meshcache_read_mdd_index(FILE *fp,
 		return false;
 	}
 
-	if (fseek(fp, index * mdd_head.verts_tot * sizeof(float) * 3, SEEK_CUR) != 0) {
+	if (fseek(fp, sizeof(float) * 3 * index * mdd_head.verts_tot, SEEK_CUR) != 0) {
 		*err_str = "Failed to seek frame";
 		return false;
 	}
diff --git a/source/blender/modifiers/intern/MOD_meshcache_pc2.c b/source/blender/modifiers/intern/MOD_meshcache_pc2.c
index 219eae4ecca..8360c8ffda7 100644
--- a/source/blender/modifiers/intern/MOD_meshcache_pc2.c
+++ b/source/blender/modifiers/intern/MOD_meshcache_pc2.c
@@ -35,6 +35,10 @@
 #  include "BLI_endian_switch.h"
 #endif
 
+#ifdef WIN32
+#  include "BLI_winstuff.h"
+#endif
+
 #include "MOD_meshcache_util.h"  /* own include */
 
 #include "DNA_modifier_types.h"
@@ -142,7 +146,7 @@ bool MOD_meshcache_read_pc2_index(FILE *fp,
 		return false;
 	}
 
-	if (fseek(fp, index * pc2_head.verts_tot * sizeof(float) * 3, SEEK_CUR) != 0) {
+	if (fseek(fp, sizeof(float) * 3 * index * pc2_head.verts_tot , SEEK_CUR) != 0) {
 		*err_str = "Failed to seek frame";
 		return false;
 	}