Fix #107420: crash getting PTCacheID when baking scene rigid body world #107536

Philipp Oeser · 2023-05-02T13:04:40+02:00

Philipp Oeser commented

2023-05-02 13:04:40 +02:00

ptcache_baker_create falsely assumed the PointCache owner id is always
an object, but when baking rigid body world it is a scene. Code
would cast the ID to an object and passed that to BKE_ptcache_id_find /
BKE_ptcache_ids_from_object (which can get terribly wrong -- reading
something on the scene as something from the assumed object).

Prior to f61ff22967 this was less likely to be a problem, but that
commit introduced a DrawDataList into the struct Scene. In the file from the report, this would lead to foreach_object_particle_ptcachenow recognizing garbage memory as a particle system, accessing itsParticleSettings phystype` would then crash (buffer-overflow).

Now pass a NULL object to BKE_ptcache_id_find in case we are having a
scene, following code still handles rigid bodies just fine (the scene is
actually passed separately as well).

`ptcache_baker_create` falsely assumed the PointCache owner id is always an **object**, but when baking rigid body world it is a **scene**. Code would cast the ID to an object and passed that to `BKE_ptcache_id_find` / `BKE_ptcache_ids_from_object` (which can get terribly wrong -- reading _something_ on the scene as something from the assumed object). Prior to f61ff22967c5 this was less likely to be a problem, but that commit introduced a `DrawDataList` into the `struct Scene. In the file from the report, this would lead to `foreach_object_particle_ptcache` now recognizing garbage memory as a particle system, accessing its `ParticleSettings` `phystype` would then crash (buffer-overflow). Now pass a NULL object to `BKE_ptcache_id_find` in case we are having a scene, following code still handles rigid bodies just fine (the scene is actually passed separately as well).

Philipp Oeser added 1 commit 2023-05-02 13:04:49 +02:00

5157303dba Fix #107420 : crash getting PTCacheID when baking scene rigid body world

`ptcache_baker_create` falsely assumed the PointCache owner id is always
an **object**, but when baking rigid body world it is a **scene**. Code
would cast the ID to an object and passed that to `BKE_ptcache_id_find` /
`BKE_ptcache_ids_from_object` (which can get terribly wrong -- reading
_something_ on the scene as something from the assumed object).

Prior to f61ff22967 this was less likely to be a problem, but that
commit introduced a `DrawDataList` into the `struct Scene. In the file
from the report, this would lead to `foreach_object_particle_ptcache`
now recognizing garbage memory as a particle system, accessing its
`ParticleSettings` `phystype` would then crash (buffer-overflow).

Now pass a NULL object to `BKE_ptcache_id_find` in case we are having a
scene, following code still handles rigid bodies just fine (the scene is
actually passed separately as well).

Philipp Oeser requested review from Sebastian Parborg 2023-05-02 13:04:58 +02:00

Philipp Oeser requested review from Lukas Tönne 2023-05-02 13:05:11 +02:00

Philipp Oeser added this to the Nodes & Physics project 2023-05-02 13:05:18 +02:00

Sebastian Parborg approved these changes 2023-05-02 15:58:31 +02:00

Sebastian Parborg left a comment

LGTM

Lukas Tönne approved these changes 2023-05-02 17:27:12 +02:00

Philipp Oeser merged commit d0c6117196 into main

2023-05-02 17:56:23 +02:00

Philipp Oeser deleted branch 107420_a

2023-05-02 17:56:24 +02:00

Philipp Oeser referenced this issue from a commit

2023-05-02 17:56:26 +02:00

Fix #107420: crash getting PTCacheID when baking scene rigid body world

Howard Trickey referenced this issue from a commit

2023-05-29 02:51:43 +02:00

Merge in orign/main:

Sign in to join this conversation.

No reviewers

No Label

Download

What's New

Blender Studio

Manual

Developers Blog

Documentation

Benchmark

Blender Conference

Development Fund

One-time Donations

Fix #107420: crash getting PTCacheID when baking scene rigid body world #107536