Fix #118225 possible crash double clicking on certain anim channels #118251

Philipp Oeser · 2024-02-14T11:50:28+01:00

Philipp Oeser commented

2024-02-14 11:50:28 +01:00

The intend in the report was to rename a linked object in the NLA
channels. The operator to rename actually does everything right, it
detects that the object is linked and passes through to other operators.

The crash then happens in the attempt to select keyframes of channels
(also doubleclick n the keymap) -- in select_anim_channel_keys.

The problem is that bAnimListElem key_data cannot be expected to be
an FCurve in all cases. Code does though, it always casts, but this is
unreliable, basically this would fail for all of the "summary" channels
or any channel type (e.g. mask layers etc.), either it is NULL or
garbage data.

So to resolve, we just check the bAnimListElem type -- if it is not
ALE_FCURVE we can early out (preventing the crash).

NOTE: this changes behavior of double clicking on a summary channel that
cannot be renamed slightly in that it will not deselect its keys anymore
(it was not selecting any keys anyways, this is actually more in line of
what would happen if you just select another channel -- this also leaves
key selection alone -- so this is actually an improvement as well imho)

The intend in the report was to rename a linked object in the NLA channels. The operator to rename actually does everything right, it detects that the object is linked and passes through to other operators. The crash then happens in the attempt to select keyframes of channels (also doubleclick n the keymap) -- in `select_anim_channel_keys`. The problem is that `bAnimListElem` `key_data` cannot be expected to be an `FCurve` in all cases. Code does though, it always casts, but this is unreliable, basically this would fail for all of the "summary" channels or any channel type (e.g. mask layers etc.), either it is NULL or garbage data. So to resolve, we just check the `bAnimListElem` type -- if it is not ALE_FCURVE we can early out (preventing the crash). NOTE: this changes behavior of double clicking on a summary channel that cannot be renamed slightly in that it will not deselect its keys anymore (it was not selecting any keys anyways, this is actually more in line of what would happen if you just select another channel -- this also leaves key selection alone -- so this is actually an improvement as well imho)

Philipp Oeser added 1 commit 2024-02-14 11:50:38 +01:00

62e4923e53 Fix #118225 possible crash double clicking on certain anim channels

The intend in the report was to rename a linked object in the NLA
channels. The operator to rename actually does everything right, it
detects that the object is linked and passes through to other operators.

The crash then happens in the attempt to select keyframes of channels
(also doubleclick n the keymap) -- in `select_anim_channel_keys`.

The problem is that `bAnimListElem` `key_data` cannot be expected to be
an `FCurve` in all cases. Code does though, it always casts, but this is
unreliable, basically this would fail for all of the "summary" channels
or any channel type (e.g. mask layers etc.), either it is NULL or
garbage data.

So to resolve, we just check the `bAnimListElem` type -- if it is not
ALE_FCURVE we can early out (preventing the crash).

NOTE: this changes behavior of double clicking on a summary channel that
cannot be renamed slightly in that it will not deselect its keys anymore
(it was not selecting any keys anyways, this is actually more in line of
what would happen if you just select another channel -- this also leaves
key selection alone -- so this is actually an improvement as well imho)

Philipp Oeser added this to the Animation & Rigging project 2024-02-14 11:50:51 +01:00

Philipp Oeser requested review from Christoph Lendenfeld 2024-02-14 11:51:02 +01:00

Philipp Oeser requested review from Sybren A. Stüvel 2024-02-14 11:51:11 +01:00

Christoph Lendenfeld approved these changes 2024-02-15 10:23:52 +01:00

Christoph Lendenfeld left a comment

good to know that ANIMFILTER_FCURVESONLY does not actually return only fcurves.
Thanks for the fix

good to know that `ANIMFILTER_FCURVESONLY` does not actually return only fcurves. Thanks for the fix

Philipp Oeser commented

2024-02-15 12:42:46 +01:00

good to know that ANIMFILTER_FCURVESONLY does not actually return only fcurves.
Thanks for the fix

That is due to 92d7f9ac56

A new Animation Filter flag was added: ANIMFILTER_FCURVESONLY. For now
this only filters out Grease Pencil Layer channels.

> good to know that `ANIMFILTER_FCURVESONLY` does not actually return only fcurves. > Thanks for the fix That is due to 92d7f9ac56e0ff1e65c364487542dfb7c32a0a67 >A new Animation Filter flag was added: `ANIMFILTER_FCURVESONLY`. For now this only filters out Grease Pencil Layer channels.

👍 1

Sybren A. Stüvel approved these changes 2024-02-16 11:55:05 +01:00

Sybren A. Stüvel left a comment

good to know that ANIMFILTER_FCURVESONLY does not actually return only fcurves.

Oh that looks like an excellent footgun.

This fix looks fine, thanks for that.

> good to know that `ANIMFILTER_FCURVESONLY` does not actually return only fcurves. Oh that looks like an excellent footgun. This fix looks fine, thanks for that.

Philipp Oeser merged commit 1a2edde400 into blender-v4.1-release

2024-02-16 12:28:22 +01:00

Philipp Oeser referenced this issue from a commit

2024-02-16 12:28:23 +01:00

Fix #118225 possible crash double clicking on certain anim channels

Philipp Oeser deleted branch 118225

2024-02-16 12:28:29 +01:00

Jeroen Bakker referenced this issue from a commit

2024-02-19 08:10:14 +01:00

Fix #118225 possible crash double clicking on certain anim channels

Philipp Oeser referenced this issue from a commit

2024-03-12 10:44:39 +01:00