[Bf-blender-cvs] [e178a273fa7] master: Fix T89247: Dereference arguments to comparison function correctly

[Fen]

Commit: e178a273fa7f5c67a617d682b1387cb42a6987cb
Author: Fen
Date:   Fri Jun 18 11:13:09 2021 +1000
Branches: master
https://developer.blender.org/rBe178a273fa7f5c67a617d682b1387cb42a6987cb

Fix T89247: Dereference arguments to comparison function correctly

`bm_face_len_cmp` incorrectly interpreted its arguments as `BMFace *`
instead of `BMFace **`, causing an out-of-bounds read.

Ref D11637

===================================================================

M	source/blender/bmesh/tools/bmesh_region_match.c

===================================================================

diff --git a/source/blender/bmesh/tools/bmesh_region_match.c b/source/blender/bmesh/tools/bmesh_region_match.c
index 561b00544b5..c538d5b17cd 100644
--- a/source/blender/bmesh/tools/bmesh_region_match.c
+++ b/source/blender/bmesh/tools/bmesh_region_match.c
@@ -553,7 +553,8 @@ static void bm_uuidwalk_pass_add(UUIDWalk *uuidwalk,
 
 static int bm_face_len_cmp(const void *v1, const void *v2)
 {
-  const BMFace *f1 = v1, *f2 = v2;
+  const BMFace *f1 = *((BMFace **)v1);
+  const BMFace *f2 = *((BMFace **)v2);
 
   if (f1->len > f2->len) {
     return 1;