archive/blender-archive
Archived
1
1
Fork 0
Code Pull Requests Packages Activity

Fix T89265: Crash when tabbing through num inputs

Browse Source 
Fix by reverting the part of ec30cf0b74
that assigned `but->editval` in `ui_numedit_begin_set_values`.

Causing access freed memory when using tab to switch
to a numeric input and then leaving the textbox by clicking outside.
This was because `ui_numedit_begin_set_values` shouldn't need to set
`but->editval` and overwrite the pointer.
This would set a pointer that had previously been freed,
causing a `NULL` check to fail later on.

Ref D11679
This commit is contained in:
Falk David
2021-06-23 14:56:36 +10:00
committed by Campbell Barton
parent 61b22d27c8
commit 071799d4fc
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
source/blender/editors/interface/interface_handlers.c
View File

@@ -3906,7 +3906,6 @@ static void ui_numedit_begin_set_values(uiBut *but, uiHandleButtonData *data)
data->startvalue = ui_but_value_get(but); data->startvalue = ui_but_value_get(but);
data->origvalue = data->startvalue; data->origvalue = data->startvalue;
data->value = data->origvalue; data->value = data->origvalue;
but->editval = &data->value;
} }
static void ui_numedit_begin(uiBut *but, uiHandleButtonData *data) static void ui_numedit_begin(uiBut *but, uiHandleButtonData *data)
@@ -3935,6 +3934,7 @@ static void ui_numedit_begin(uiBut *but, uiHandleButtonData *data)
} }
else { else {
ui_numedit_begin_set_values(but, data); ui_numedit_begin_set_values(but, data);
but->editval = &data->value;
float softmin = but->softmin; float softmin = but->softmin;
float softmax = but->softmax; float softmax = but->softmax;