caiyu/solvespace
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix use-after-free in revolve and helix.

Browse Source 
Pointers get invalidated if a list has to be re-allocated.
CopyEntity can do that.
This commit is contained in:
Ryan Pavlik 2019-09-09 14:04:40 -05:00 committed by whitequark
parent a4c0022815
commit d514a26f92
1 changed files with 13 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
src/group.cpp
View File

@ -567,8 +567,9 @@ void Group::Generate(IdList<Entity,hEntity> *entity,
int ai = 1; int ai = 1;
// Not using range-for here because we're changing the size of entity in the loop.
for(i = 0; i < entity->n; i++) { for(i = 0; i < entity->n; i++) {
Entity *e = &((*entity)[i]); Entity *e = &(entity->Get(i));
if(e->group != opA) if(e->group != opA)
continue; continue;
@ -579,6 +580,8 @@ void Group::Generate(IdList<Entity,hEntity> *entity,
NO_PARAM, NO_PARAM, NO_PARAM, NO_PARAM, NO_PARAM, NO_PARAM, CopyAs::NUMERIC); NO_PARAM, NO_PARAM, NO_PARAM, NO_PARAM, NO_PARAM, NO_PARAM, CopyAs::NUMERIC);
for(a = 0; a < 2; a++) { for(a = 0; a < 2; a++) {
//! @todo is this check redundant?
Entity *e = &(entity->Get(i));
if(e->group != opA) if(e->group != opA)
continue; continue;
@ -616,6 +619,7 @@ void Group::Generate(IdList<Entity,hEntity> *entity,
int ai = 1; int ai = 1;
// Not using range-for here because we're changing the size of entity in the loop.
for(i = 0; i < entity->n; i++) { for(i = 0; i < entity->n; i++) {
Entity *e = &(entity->Get(i)); Entity *e = &(entity->Get(i));
if(e->group.v != opA.v) if(e->group.v != opA.v)
@ -627,16 +631,19 @@ void Group::Generate(IdList<Entity,hEntity> *entity,
NO_PARAM, NO_PARAM, NO_PARAM, NO_PARAM, NO_PARAM, NO_PARAM, CopyAs::NUMERIC); NO_PARAM, NO_PARAM, NO_PARAM, NO_PARAM, NO_PARAM, NO_PARAM, CopyAs::NUMERIC);
for(a = 0; a < 2; a++) { for(a = 0; a < 2; a++) {
Entity *e = &(entity->Get(i));
e->CalculateNumerical(false); e->CalculateNumerical(false);
CopyEntity(entity, e, a * 2 - (subtype == Subtype::ONE_SIDED ? 0 : 1), CopyEntity(entity, e, a * 2 - (subtype == Subtype::ONE_SIDED ? 0 : 1),
(a == 1) ? REMAP_LATHE_END : REMAP_LATHE_START, h.param(0), (a == 1) ? REMAP_LATHE_END : REMAP_LATHE_START, h.param(0),
h.param(1), h.param(2), h.param(3), h.param(4), h.param(5), h.param(1), h.param(2), h.param(3), h.param(4), h.param(5),
h.param(6), h.param(7), CopyAs::N_ROT_AXIS_TRANS); h.param(6), h.param(7), CopyAs::N_ROT_AXIS_TRANS);
} }
// For point entities on the axis, create a construction line // For point entities on the axis, create a construction line
e = &(entity->Get(i));
if(e->IsPoint()) { if(e->IsPoint()) {
Vector check = e->PointGetNum().Minus(axis_pos).Cross(axis_dir); Vector check = e->PointGetNum().Minus(axis_pos).Cross(axis_dir);
if (check.Dot(check) < LENGTH_EPS) { if (check.Dot(check) < LENGTH_EPS) {
//! @todo isn't this the same as &(ent[i])?
Entity *ep = SK.GetEntity(e->h); Entity *ep = SK.GetEntity(e->h);
Entity en = {}; Entity en = {};
// A point gets extruded to form a line segment // A point gets extruded to form a line segment
@ -649,7 +656,7 @@ void Group::Generate(IdList<Entity,hEntity> *entity,
en.type = Entity::Type::LINE_SEGMENT; en.type = Entity::Type::LINE_SEGMENT;
entity->Add(&en); entity->Add(&en);
} }
} }
ai++; ai++;
} }
return; return;