Fix: is_overridable crash with certain ShapeKey functions parameters #118453

Philipp Oeser · 2024-02-19T11:26:59+01:00

Philipp Oeser commented

2024-02-19 11:26:59 +01:00

Probably caused by 337e2c9029

rna_Property_overridable_get does rna_idproperty_check [which also
tries to set PropertyRNAOrID array_len].

In case of ShapeKey normals functions (normals_XXX_get()) "normals"
parameters, this then tries to get the length via e.g
rna_KeyBlock_normals_vert_len, but without an ID or owner_id. This is
OK (since we are querying just for the general function, so not with a
specific ID), but crashes since rna_ShapeKey_find_key further down the
line accesses the (NULL) ID.

So solution here is to guard in rna_ShapeKey_find_key against a non-ID
(and rightfully return NULL here).

NOTE there might be other cases where rna_Property_overridable_get
might fail after the behavior change of 337e2c9029 due to the above
(but havent spotted any nor found other reports about this).

Fixes #106406

Probably caused by 337e2c902930 `rna_Property_overridable_get` does `rna_idproperty_check` [which also tries to set `PropertyRNAOrID` `array_len`]. In case of ShapeKey normals functions (normals_XXX_get()) "normals" parameters, this then tries to get the length via e.g `rna_KeyBlock_normals_vert_len`, but without an ID or owner_id. This is OK (since we are querying just for the general function, so not with a specific ID), but crashes since `rna_ShapeKey_find_key` further down the line accesses the (NULL) ID. So solution here is to guard in `rna_ShapeKey_find_key` against a non-ID (and rightfully return NULL here). NOTE there might be other cases where `rna_Property_overridable_get` might fail after the behavior change of 337e2c902930 due to the above (but havent spotted any nor found other reports about this). Fixes #106406

Philipp Oeser added 1 commit 2024-02-19 11:27:09 +01:00

da215bf839 Fix: `is_overridable` crash with certain ShapeKey functions parameters

Probably caused by 337e2c9029

`rna_Property_overridable_get` does `rna_idproperty_check` [which also
tries to set `PropertyRNAOrID` `array_len`].

In case of ShapeKey normals functions (normals_XXX_get()) "normals"
parameters, this then tries to get the length via e.g
`rna_KeyBlock_normals_vert_len`, but without an ID or owner_id. This is
OK (since we are querying just for the general function, so not with a
specific ID), but crashes since `rna_ShapeKey_find_key` further down the
line accesses the (NULL) ID.

So solution here is to guard in `rna_ShapeKey_find_key` against a non-ID
(and rightfully return NULL here).

NOTE there might be other cases where `rna_Property_overridable_get`
might fail after the behavior change of 337e2c9029 due to the above
(but havent spotted any nor found other reports about this).

Fixes #106406

Philipp Oeser requested review from Bastien Montagne 2024-02-19 11:27:21 +01:00

Philipp Oeser added this to the Core project 2024-02-19 11:27:35 +01:00

Philipp Oeser added the

Download

What's New

Blender Studio

Manual

Developers Blog

Documentation

Benchmark

Blender Conference

Development Fund

One-time Donations

Fix: is_overridable crash with certain ShapeKey functions parameters #118453

Checkout

Fix: `is_overridable` crash with certain ShapeKey functions parameters #118453