[Bf-blender-cvs] [e0ae229acb2] blender-v2.83-release: Fix potential crash due to dyntopo GPU buffer invalid memory access

[Brecht Van Lommel]

Commit: e0ae229acb2aa63ffba05dc53045577dbb876acf
Author: Brecht Van Lommel
Date:   Mon May 18 18:07:09 2020 +0200
Branches: blender-v2.83-release
https://developer.blender.org/rBe0ae229acb2aa63ffba05dc53045577dbb876acf

Fix potential crash due to dyntopo GPU buffer invalid memory access

When the number of triangles in a node became zero, the wireframe batch was
not freed along with the triangles batch and could still reference a freed
vertex buffer.

Ref T76858

===================================================================

M	source/blender/gpu/intern/gpu_buffers.c

===================================================================

diff --git a/source/blender/gpu/intern/gpu_buffers.c b/source/blender/gpu/intern/gpu_buffers.c
index e9061f1a029..5221cc09ad9 100644
--- a/source/blender/gpu/intern/gpu_buffers.c
+++ b/source/blender/gpu/intern/gpu_buffers.c
@@ -1083,13 +1083,24 @@ short GPU_pbvh_buffers_material_index_get(GPU_PBVH_Buffers *buffers)
   return buffers->material_index;
 }
 
+static void gpu_pbvh_buffers_clear(GPU_PBVH_Buffers *buffers)
+{
+  GPU_BATCH_DISCARD_SAFE(buffers->lines);
+  GPU_BATCH_DISCARD_SAFE(buffers->lines_fast);
+  GPU_BATCH_DISCARD_SAFE(buffers->triangles);
+  GPU_BATCH_DISCARD_SAFE(buffers->triangles_fast);
+  GPU_INDEXBUF_DISCARD_SAFE(buffers->index_lines_buf_fast);
+  GPU_INDEXBUF_DISCARD_SAFE(buffers->index_lines_buf);
+  GPU_INDEXBUF_DISCARD_SAFE(buffers->index_buf_fast);
+  GPU_INDEXBUF_DISCARD_SAFE(buffers->index_buf);
+  GPU_VERTBUF_DISCARD_SAFE(buffers->vert_buf);
+}
+
 void GPU_pbvh_buffers_update_flush(GPU_PBVH_Buffers *buffers)
 {
   /* Free empty bmesh node buffers. */
   if (buffers->clear_bmesh_on_flush) {
-    GPU_BATCH_DISCARD_SAFE(buffers->triangles);
-    GPU_INDEXBUF_DISCARD_SAFE(buffers->index_buf);
-    GPU_VERTBUF_DISCARD_SAFE(buffers->vert_buf);
+    gpu_pbvh_buffers_clear(buffers);
     buffers->clear_bmesh_on_flush = false;
   }
 
@@ -1102,16 +1113,7 @@ void GPU_pbvh_buffers_update_flush(GPU_PBVH_Buffers *buffers)
 void GPU_pbvh_buffers_free(GPU_PBVH_Buffers *buffers)
 {
   if (buffers) {
-    GPU_BATCH_DISCARD_SAFE(buffers->lines);
-    GPU_BATCH_DISCARD_SAFE(buffers->lines_fast);
-    GPU_BATCH_DISCARD_SAFE(buffers->triangles);
-    GPU_BATCH_DISCARD_SAFE(buffers->triangles_fast);
-    GPU_INDEXBUF_DISCARD_SAFE(buffers->index_lines_buf_fast);
-    GPU_INDEXBUF_DISCARD_SAFE(buffers->index_lines_buf);
-    GPU_INDEXBUF_DISCARD_SAFE(buffers->index_buf_fast);
-    GPU_INDEXBUF_DISCARD_SAFE(buffers->index_buf);
-    GPU_VERTBUF_DISCARD_SAFE(buffers->vert_buf);
-
+    gpu_pbvh_buffers_clear(buffers);
     MEM_freeN(buffers);
   }
 }