[Bf-blender-cvs] [8dd18a77e72] blender-v2.83-release: Fix T89247: Dereference arguments to comparison function correctly

[Fen]

Commit: 8dd18a77e72444c5a9cc60c1043fa96b28260d9a
Author: Fen
Date:   Fri Jun 18 11:13:09 2021 +1000
Branches: blender-v2.83-release
https://developer.blender.org/rB8dd18a77e72444c5a9cc60c1043fa96b28260d9a

Fix T89247: Dereference arguments to comparison function correctly

`bm_face_len_cmp` incorrectly interpreted its arguments as `BMFace *`
instead of `BMFace **`, causing an out-of-bounds read.

Ref D11637

===================================================================

M	source/blender/bmesh/tools/bmesh_region_match.c

===================================================================

diff --git a/source/blender/bmesh/tools/bmesh_region_match.c b/source/blender/bmesh/tools/bmesh_region_match.c
index 44761b9f37e..67219dbd8cb 100644
--- a/source/blender/bmesh/tools/bmesh_region_match.c
+++ b/source/blender/bmesh/tools/bmesh_region_match.c
@@ -561,7 +561,8 @@ static void bm_uuidwalk_pass_add(UUIDWalk *uuidwalk,
 
 static int bm_face_len_cmp(const void *v1, const void *v2)
 {
-  const BMFace *f1 = v1, *f2 = v2;
+  const BMFace *f1 = *((BMFace **)v1);
+  const BMFace *f2 = *((BMFace **)v2);
 
   if (f1->len > f2->len) {
     return 1;