Cr8-xyz/blender
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Fix crash loading .blend files that have multiple outliners in a screen, saved

Browse Source 
with recent outliner optimizations (revision 58855, 3 days ago), in any Blender
version before this commit. On current Blender it would give a double free
warning in the console.

The problem is that it creates a temporary TreeStore on file save. However if you
have multiple outliners this memory block would always be at the same memory
address making it no longer unique. That then meant old memory address lookups on
file read were failing. Solution now is to postpone freeing these temporary memory
blocks until the end so that they are at unique addresses.
This commit is contained in:
Brecht Van Lommel
2013-08-06 05:35:54 +00:00
parent 90b22486c7
commit bff75bafbd
1 changed files with 32 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

44
source/blender/blenloader/intern/writefile.c
View File

@@ -2394,7 +2394,7 @@ static void write_region(WriteData *wd, ARegion *ar, int spacetype)
}
}
static void write_soops(WriteData *wd, SpaceOops *so)
static void write_soops(WriteData *wd, SpaceOops *so, LinkNode **tmp_mem_list)
{
BLI_mempool *ts = so->treestore;
@@ -2402,18 +2402,35 @@ static void write_soops(WriteData *wd, SpaceOops *so)
int elems = BLI_mempool_count(ts);
/* linearize mempool to array */
TreeStoreElem *data = elems ? BLI_mempool_as_arrayN(ts, "TreeStoreElem") : NULL;
TreeStore ts_flat = {elems, elems, data};
/* temporarily replace mempool-treestore by flat-treestore */
so->treestore = (BLI_mempool *)&ts_flat;
writestruct(wd, DATA, "SpaceOops", 1, so);
if (data) {
TreeStore *ts_flat = MEM_callocN(sizeof(TreeStore), "TreeStore");
ts_flat->usedelem = elems;
ts_flat->totelem = elems;
ts_flat->data = data;
/* temporarily replace mempool-treestore by flat-treestore */
so->treestore = (BLI_mempool *)ts_flat;
writestruct(wd, DATA, "SpaceOops", 1, so);
writestruct(wd, DATA, "TreeStore", 1, ts_flat);
writestruct(wd, DATA, "TreeStoreElem", elems, data);
/* we do not free the pointers immediately, because if we have multiple
* outliners in a screen we might get the same address on the next
* malloc, which makes the address no longer unique and so invalid for
* lookups on file read, causing crashes or double frees */
BLI_linklist_append(tmp_mem_list, ts_flat);
BLI_linklist_append(tmp_mem_list, data);
}
else {
so->treestore = NULL;
writestruct(wd, DATA, "SpaceOops", 1, so);
}
/* restore old treestore */
so->treestore = ts;
writestruct(wd, DATA, "TreeStore", 1, &ts_flat);
if (data) {
writestruct(wd, DATA, "TreeStoreElem", elems, data);
MEM_freeN(data);
}
} else {
writestruct(wd, DATA, "SpaceOops", 1, so);
}
@@ -2425,6 +2442,7 @@ static void write_screens(WriteData *wd, ListBase *scrbase)
ScrArea *sa;
ScrVert *sv;
ScrEdge *se;
LinkNode *tmp_mem_list = NULL;
sc= scrbase->first;
while (sc) {
@@ -2501,7 +2519,7 @@ static void write_screens(WriteData *wd, ListBase *scrbase)
}
else if (sl->spacetype==SPACE_OUTLINER) {
SpaceOops *so= (SpaceOops *)sl;
write_soops(wd, so);
write_soops(wd, so, &tmp_mem_list);
}
else if (sl->spacetype==SPACE_IMAGE) {
SpaceImage *sima= (SpaceImage *)sl;
@@ -2566,6 +2584,8 @@ static void write_screens(WriteData *wd, ListBase *scrbase)
sc= sc->id.next;
}
BLI_linklist_freeN(tmp_mem_list);
/* flush helps the compression for undo-save */
mywrite(wd, MYWRITE_FLUSH, 0);