archive/blender-archive
Archived
1
1
Fork 0
Code Pull Requests Packages Activity

Fix T94708: negative reference count error with Python API callbacks

Browse Source 
Regression in 7972785d7b that caused
Python callback arguments to be de-referenced twice - potentially
accessing freed memory. Making a new-file with a circle-select
tool active triggered this (for example).

Now arguments aren't de-referenced when Blender it's self has already
removed the callback handle.
This commit is contained in:
Campbell Barton
2022-01-07 16:32:01 +11:00
parent 1642028310
commit f24854005d
3 changed files with 15 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
source/blender/python/intern/bpy_rna_callback.c
View File

@@ -383,6 +383,7 @@ PyObject *pyrna_callback_classmethod_remove(PyObject *UNUSED(self), PyObject *ar
void *handle;
StructRNA *srna;
bool capsule_clear = false;
bool handle_removed = false;
if (PyTuple_GET_SIZE(args) < 2) {
PyErr_SetString(PyExc_ValueError, "callback_remove(handler): expected at least 2 args");
@@ -406,7 +407,7 @@ PyObject *pyrna_callback_classmethod_remove(PyObject *UNUSED(self), PyObject *ar
args, "OO!:WindowManager.draw_cursor_remove", &cls, &PyCapsule_Type, &py_handle)) {
return NULL;
}
WM_paint_cursor_end(handle);
handle_removed = WM_paint_cursor_end(handle);
capsule_clear = true;
}
else if (RNA_struct_is_a(srna, &RNA_Space)) {
@@ -445,7 +446,7 @@ PyObject *pyrna_callback_classmethod_remove(PyObject *UNUSED(self), PyObject *ar
params.region_type_enum.value_orig);
return NULL;
}
ED_region_draw_cb_exit(art, handle);
handle_removed = ED_region_draw_cb_exit(art, handle);
capsule_clear = true;
}
else {
@@ -453,9 +454,14 @@ PyObject *pyrna_callback_classmethod_remove(PyObject *UNUSED(self), PyObject *ar
return NULL;
}
/* The handle has been removed, so decrement its customdata. */
PyObject *handle_args = PyCapsule_GetContext(py_handle);
Py_DECREF(handle_args);
/* When `handle_removed == false`: Blender has already freed the data
* (freeing screen data when loading a new file for example).
* This will have already decremented the user, so don't decrement twice. */
if (handle_removed == true) {
/* The handle has been removed, so decrement its custom-data. */
PyObject *handle_args = PyCapsule_GetContext(py_handle);
Py_DECREF(handle_args);
}
/* don't allow reuse */
if (capsule_clear) {