[Bf-blender-cvs] [9b9f84b317f] blender-v2.83-release: Fix crash when converting BMesh to Mesh with shape keys

[Sybren A. Stüvel]

Commit: 9b9f84b317feff9454f124330bd3aa774493c003
Author: Sybren A. Stüvel
Date:   Mon May 25 09:43:01 2020 +0200
Branches: blender-v2.83-release
https://developer.blender.org/rB9b9f84b317feff9454f124330bd3aa774493c003

Fix crash when converting BMesh to Mesh with shape keys

The `BM_mesh_bm_to_me()` function copies shape keys from the BMesh to
the Mesh. However, it tries to copy the same number of shape keys as are
defined on the target mesh. Since the target mesh does not necessarily
have the same number of shape keys as the BMesh, this would crash if the
target Mesh has more.

Found while performing some tests for {D7785}.

Differential Revision: https://developer.blender.org/D7818

Reviewed by: brecht

===================================================================

M	source/blender/bmesh/intern/bmesh_mesh_conv.c

===================================================================

diff --git a/source/blender/bmesh/intern/bmesh_mesh_conv.c b/source/blender/bmesh/intern/bmesh_mesh_conv.c
index de32d7881b0..b8508f7e12c 100644
--- a/source/blender/bmesh/intern/bmesh_mesh_conv.c
+++ b/source/blender/bmesh/intern/bmesh_mesh_conv.c
@@ -893,6 +893,10 @@ void BM_mesh_bm_to_me(Main *bmain, BMesh *bm, Mesh *me, const struct BMeshToMesh
 
       j = bm_to_mesh_shape_layer_index_from_kb(bm, currkey);
       cd_shape_offset = CustomData_get_n_offset(&bm->vdata, CD_SHAPEKEY, j);
+      if (cd_shape_offset < 0) {
+        /* The target Mesh has more shapekeys than the BMesh. */
+        continue;
+      }
 
       fp = newkey = MEM_callocN(me->key->elemsize * bm->totvert, "currkey->data");
       oldkey = currkey->data;