[Bf-blender-cvs] [3cafaf0fa86] master: Fix possible use-after-free for number slider buttons

[Julian Eisel]

Commit: 3cafaf0fa86859e81af21d55f0dbfc8c0e1b70a0
Author: Julian Eisel
Date:   Thu Sep 10 15:28:55 2020 +0200
Branches: master
https://developer.blender.org/rB3cafaf0fa86859e81af21d55f0dbfc8c0e1b70a0

Fix possible use-after-free for number slider buttons

Mistake in e6f0b60c2e91.

===================================================================

M	source/blender/editors/interface/interface_layout.c

===================================================================

diff --git a/source/blender/editors/interface/interface_layout.c b/source/blender/editors/interface/interface_layout.c
index 62321cb1e73..a37f87e593b 100644
--- a/source/blender/editors/interface/interface_layout.c
+++ b/source/blender/editors/interface/interface_layout.c
@@ -632,7 +632,7 @@ static void ui_item_array(uiLayout *layout,
         uiButNumber *number_but = (uiButNumber *)but;
 
         but->a1 = number_but->step_size;
-        ui_but_change_type(but, UI_BTYPE_NUM_SLIDER);
+        but = ui_but_change_type(but, UI_BTYPE_NUM_SLIDER);
       }
     }
   }
@@ -703,7 +703,7 @@ static void ui_item_array(uiLayout *layout,
           uiButNumber *number_but = (uiButNumber *)but;
 
           but->a1 = number_but->step_size;
-          ui_but_change_type(but, UI_BTYPE_NUM_SLIDER);
+          but = ui_but_change_type(but, UI_BTYPE_NUM_SLIDER);
         }
         if ((toggle == 1) && but->type == UI_BTYPE_CHECKBOX) {
           but->type = UI_BTYPE_TOGGLE;
@@ -2299,7 +2299,7 @@ void uiItemFullR(uiLayout *layout,
       uiButNumber *num_but = (uiButNumber *)but;
 
       but->a1 = num_but->step_size;
-      ui_but_change_type(but, UI_BTYPE_NUM_SLIDER);
+      but = ui_but_change_type(but, UI_BTYPE_NUM_SLIDER);
     }
 
     if (flag & UI_ITEM_R_CHECKBOX_INVERT) {