[Bf-blender-cvs] [35e50c170c4] master: Fix panel type use after free when reloading scripts

[Hans Goudey]

Commit: 35e50c170c4a596c947bd6e642a3a2c64ac114f7
Author: Hans Goudey
Date:   Wed Oct 21 08:25:46 2020 -0500
Branches: master
https://developer.blender.org/rB35e50c170c4a596c947bd6e642a3a2c64ac114f7

Fix panel type use after free when reloading scripts

In order to prevent the panel code from using the type after it is freed,
the field needs to be set to NULL. This needs to be done recursively
for subpanels as well as top-level panels.

===================================================================

M	source/blender/makesrna/intern/rna_ui.c

===================================================================

diff --git a/source/blender/makesrna/intern/rna_ui.c b/source/blender/makesrna/intern/rna_ui.c
index d637e011777..5179c4e538a 100644
--- a/source/blender/makesrna/intern/rna_ui.c
+++ b/source/blender/makesrna/intern/rna_ui.c
@@ -180,6 +180,17 @@ static void panel_draw_header_preset(const bContext *C, Panel *panel)
   RNA_parameter_list_free(&list);
 }
 
+static void remove_panel_type_recursive(Panel *panel, const PanelType *pt)
+{
+  if (panel->type == pt) {
+    panel->type = NULL;
+  }
+
+  LISTBASE_FOREACH (Panel *, child_panel, &panel->children) {
+    remove_panel_type_recursive(child_panel, pt);
+  }
+}
+
 static void rna_Panel_unregister(Main *bmain, StructRNA *type)
 {
   ARegionType *art;
@@ -220,9 +231,7 @@ static void rna_Panel_unregister(Main *bmain, StructRNA *type)
           LISTBASE_FOREACH (ARegion *, region, regionbase) {
             if (region->type == art) {
               LISTBASE_FOREACH (Panel *, panel, &region->panels) {
-                if (panel->type == pt) {
-                  panel->type = NULL;
-                }
+                remove_panel_type_recursive(panel, pt);
               }
             }
             /* The unregistered panel might have had a template that added instanced panels,