From a27acaf35687b60d537f84e92b872680b687b9ea Mon Sep 17 00:00:00 2001 From: Andrey Kleshchev Date: Wed, 20 Aug 2025 20:43:10 +0300 Subject: #4583 Crash on LLInventoryPanel::itemChanged --- indra/newview/llinventorypanel.cpp | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/indra/newview/llinventorypanel.cpp b/indra/newview/llinventorypanel.cpp index b2dd47548c..590cbbec4e 100644 --- a/indra/newview/llinventorypanel.cpp +++ b/indra/newview/llinventorypanel.cpp @@ -770,6 +770,7 @@ void LLInventoryPanel::itemChanged(const LLUUID& item_id, U32 mask, const LLInve // Remove the item's UI. LLFolderViewFolder* parent = view_item->getParentFolder(); removeItemID(viewmodel_item->getUUID()); + bool was_favorite = view_item->isFavorite(); view_item->destroyView(); if(parent) { @@ -783,7 +784,7 @@ void LLInventoryPanel::itemChanged(const LLUUID& item_id, U32 mask, const LLInve updateFolderLabel(viewmodel_folder->getUUID()); } } - if (view_item->isFavorite()) + if (was_favorite) { parent->updateHasFavorites(false); // favorite was removed } @@ -2452,6 +2453,7 @@ bool LLInventoryFavoritesItemsPanel::removeFavorite(const LLUUID& id, const LLIn { removeItemID(viewmodel_item->getUUID()); } + bool was_favorite = view_item->isFavorite(); view_item->destroyView(); if (parent) { @@ -2461,7 +2463,7 @@ bool LLInventoryFavoritesItemsPanel::removeFavorite(const LLUUID& id, const LLIn { updateFolderLabel(viewmodel_folder->getUUID()); } - if (view_item->isFavorite()) + if (was_favorite) { parent->updateHasFavorites(false); // favorite was removed } -- cgit v1.3 From e01c4477450857be7b20ffd7db402738fad31946 Mon Sep 17 00:00:00 2001 From: Andrey Kleshchev Date: Wed, 20 Aug 2025 20:54:28 +0300 Subject: #4581 Crash on LL::GLTF::copy Tried to initialize LLVector2 TexCoords with vector3 data? --- indra/newview/gltf/buffer_util.h | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/indra/newview/gltf/buffer_util.h b/indra/newview/gltf/buffer_util.h index be36c5e90b..c231443a9e 100644 --- a/indra/newview/gltf/buffer_util.h +++ b/indra/newview/gltf/buffer_util.h @@ -146,6 +146,12 @@ namespace LL dst.set(src[0], src[1]); } + template<> + inline void copyVec3(F32* src, LLVector2& dst) + { + dst.set(src[0], src[1]); + } + template<> inline void copyVec3(F32* src, vec3& dst) { @@ -375,12 +381,18 @@ namespace LL template inline void copy(Asset& asset, Accessor& accessor, LLStrider& dst) { - if (accessor.mBufferView == INVALID_INDEX) + if (accessor.mBufferView == INVALID_INDEX + || accessor.mBufferView >= asset.mBufferViews.size()) { LL_WARNS("GLTF") << "Invalid buffer" << LL_ENDL; return; } const BufferView& bufferView = asset.mBufferViews[accessor.mBufferView]; + if (bufferView.mBuffer >= asset.mBuffers.size()) + { + LL_WARNS("GLTF") << "Invalid buffer view" << LL_ENDL; + return; + } const Buffer& buffer = asset.mBuffers[bufferView.mBuffer]; const U8* src = buffer.mData.data() + bufferView.mByteOffset + accessor.mByteOffset; -- cgit v1.3 From 787b63f4c29f6ef56f355ec80084458a1bbcfb35 Mon Sep 17 00:00:00 2001 From: Andrey Kleshchev Date: Wed, 20 Aug 2025 20:33:59 +0300 Subject: #3922 Crash on removeStringNoUndo --- indra/llui/lltextbase.cpp | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/indra/llui/lltextbase.cpp b/indra/llui/lltextbase.cpp index 7007049e1c..382847d68f 100644 --- a/indra/llui/lltextbase.cpp +++ b/indra/llui/lltextbase.cpp @@ -1069,6 +1069,14 @@ S32 LLTextBase::insertStringNoUndo(S32 pos, const LLWString &wstr, LLTextBase::s S32 LLTextBase::removeStringNoUndo(S32 pos, S32 length) { + S32 text_length = (S32)getLength(); + if (pos >= text_length || pos < 0) + { + return 0; // nothing to remove + } + // Clamp length to not go past the end of the text + length = std::min(length, text_length - pos); + beforeValueChange(); segment_set_t::iterator seg_iter = getSegIterContaining(pos); while(seg_iter != mSegments.end()) -- cgit v1.3