archive/blender-archive
Archived
1
1
Fork 0
Code Pull Requests Packages Activity

Fix gpu.types.GPUTexture crash when the size argument was too big

Browse Source 
Missing length check on the size argument before copying it
into a fixed size buffer.
This commit is contained in:
Campbell Barton
2021-07-29 14:09:30 +10:00
parent fd0b2b8dfd
commit 3c50687073
1 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
source/blender/python/gpu/gpu_py_texture.c
View File

@@ -153,6 +153,12 @@ static PyObject *pygpu_texture__tp_new(PyTypeObject *UNUSED(self), PyObject *arg
int len = 1; int len = 1;
if (PySequence_Check(py_size)) { if (PySequence_Check(py_size)) {
len = PySequence_Size(py_size); len = PySequence_Size(py_size);
if ((len < 1) || (len > 3)) {
PyErr_Format(PyExc_ValueError,
"GPUTexture.__new__: \"size\" must be between 1 and 3 in length (got %d)",
len);
return NULL;
}
if (PyC_AsArray(size, sizeof(*size), py_size, len, &PyLong_Type, "GPUTexture.__new__") == -1) { if (PyC_AsArray(size, sizeof(*size), py_size, len, &PyLong_Type, "GPUTexture.__new__") == -1) {
return NULL; return NULL;
} }