[Bf-blender-cvs] [953a031f15e] master: UI: Fix use after free for instanced panel expansion

[Hans Goudey]

Commit: 953a031f15e077674e92585cbb085021678860c3
Author: Hans Goudey
Date:   Thu Sep 3 14:33:44 2020 -0500
Branches: master
https://developer.blender.org/rB953a031f15e077674e92585cbb085021678860c3

UI: Fix use after free for instanced panel expansion

The "set_expand_from_list_data" function has to be called after updating
the panels' custom data pointers. Otherwise the wrong information is
retrieved in the best base and it will cause a crash in the worst case.

===================================================================

M	source/blender/editors/interface/interface_templates.c

===================================================================

diff --git a/source/blender/editors/interface/interface_templates.c b/source/blender/editors/interface/interface_templates.c
index c27279ab744..f917b65be75 100644
--- a/source/blender/editors/interface/interface_templates.c
+++ b/source/blender/editors/interface/interface_templates.c
@@ -1890,13 +1890,6 @@ void uiTemplateModifiers(uiLayout *UNUSED(layout), bContext *C)
     }
   }
   else {
-    /* The expansion might have been changed elsewhere, so we still need to set it. */
-    LISTBASE_FOREACH (Panel *, panel, &region->panels) {
-      if ((panel->type != NULL) && (panel->type->flag & PNL_INSTANCED)) {
-        UI_panel_set_expand_from_list_data(C, panel);
-      }
-    }
-
     /* Assuming there's only one group of instanced panels, update the custom data pointers. */
     Panel *panel = region->panels.first;
     LISTBASE_FOREACH (ModifierData *, md, modifiers) {
@@ -1917,6 +1910,13 @@ void uiTemplateModifiers(uiLayout *UNUSED(layout), bContext *C)
 
       panel = panel->next;
     }
+
+    /* The expansion might have been changed elsewhere, so we still need to set it. */
+    LISTBASE_FOREACH (Panel *, panel_iter, &region->panels) {
+      if ((panel_iter->type != NULL) && (panel_iter->type->flag & PNL_INSTANCED)) {
+        UI_panel_set_expand_from_list_data(C, panel_iter);
+      }
+    }
   }
 }
 
@@ -2068,13 +2068,6 @@ void uiTemplateConstraints(uiLayout *UNUSED(layout), bContext *C, bool use_bone_
     }
   }
   else {
-    /* The expansion might have been changed elsewhere, so we still need to set it. */
-    LISTBASE_FOREACH (Panel *, panel, &region->panels) {
-      if ((panel->type != NULL) && (panel->type->flag & PNL_INSTANCED)) {
-        UI_panel_set_expand_from_list_data(C, panel);
-      }
-    }
-
     /* Assuming there's only one group of instanced panels, update the custom data pointers. */
     Panel *panel = region->panels.first;
     LISTBASE_FOREACH (bConstraint *, con, constraints) {
@@ -2090,6 +2083,13 @@ void uiTemplateConstraints(uiLayout *UNUSED(layout), bContext *C, bool use_bone_
 
       panel = panel->next;
     }
+
+    /* The expansion might have been changed elsewhere, so we still need to set it. */
+    LISTBASE_FOREACH (Panel *, panel_iter, &region->panels) {
+      if ((panel_iter->type != NULL) && (panel_iter->type->flag & PNL_INSTANCED)) {
+        UI_panel_set_expand_from_list_data(C, panel_iter);
+      }
+    }
   }
 }
 
@@ -2144,13 +2144,6 @@ void uiTemplateGpencilModifiers(uiLayout *UNUSED(layout), bContext *C)
     }
   }
   else {
-    /* The expansion might have been changed elsewhere, so we still need to set it. */
-    LISTBASE_FOREACH (Panel *, panel, &region->panels) {
-      if ((panel->type != NULL) && (panel->type->flag & PNL_INSTANCED)) {
-        UI_panel_set_expand_from_list_data(C, panel);
-      }
-    }
-
     /* Assuming there's only one group of instanced panels, update the custom data pointers. */
     Panel *panel = region->panels.first;
     LISTBASE_FOREACH (ModifierData *, md, modifiers) {
@@ -2171,6 +2164,13 @@ void uiTemplateGpencilModifiers(uiLayout *UNUSED(layout), bContext *C)
 
       panel = panel->next;
     }
+
+    /* The expansion might have been changed elsewhere, so we still need to set it. */
+    LISTBASE_FOREACH (Panel *, panel_iter, &region->panels) {
+      if ((panel_iter->type != NULL) && (panel_iter->type->flag & PNL_INSTANCED)) {
+        UI_panel_set_expand_from_list_data(C, panel_iter);
+      }
+    }
   }
 }
 
@@ -2226,13 +2226,6 @@ void uiTemplateShaderFx(uiLayout *UNUSED(layout), bContext *C)
     }
   }
   else {
-    /* The expansion might have been changed elsewhere, so we still need to set it. */
-    LISTBASE_FOREACH (Panel *, panel, &region->panels) {
-      if ((panel->type != NULL) && (panel->type->flag & PNL_INSTANCED)) {
-        UI_panel_set_expand_from_list_data(C, panel);
-      }
-    }
-
     /* Assuming there's only one group of instanced panels, update the custom data pointers. */
     Panel *panel = region->panels.first;
     LISTBASE_FOREACH (ShaderFxData *, fx, shaderfx) {
@@ -2253,6 +2246,13 @@ void uiTemplateShaderFx(uiLayout *UNUSED(layout), bContext *C)
 
       panel = panel->next;
     }
+
+    /* The expansion might have been changed elsewhere, so we still need to set it. */
+    LISTBASE_FOREACH (Panel *, panel_iter, &region->panels) {
+      if ((panel_iter->type != NULL) && (panel_iter->type->flag & PNL_INSTANCED)) {
+        UI_panel_set_expand_from_list_data(C, panel_iter);
+      }
+    }
   }
 }