From b30430c7be68c21a316efa59765e14a1ab912c9e Mon Sep 17 00:00:00 2001 From: wmayer Date: Mon, 9 Dec 2024 11:05:14 +0100 Subject: [PATCH] Sketch: Fix possible crash in BSpline::splineValue There is an underflow of an unsigned int in the calling instance that sets the parameter 'p' to 2**32-1. But the size of the passed vector is 0. To fix the crash first check if p is less then the size of the vector. See: https://forum.freecad.org/viewtopic.php?t=92815 --- src/Mod/Sketcher/App/planegcs/Geo.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/Mod/Sketcher/App/planegcs/Geo.cpp b/src/Mod/Sketcher/App/planegcs/Geo.cpp index b46ce7c0f71b..cbb4e30983b8 100644 --- a/src/Mod/Sketcher/App/planegcs/Geo.cpp +++ b/src/Mod/Sketcher/App/planegcs/Geo.cpp @@ -1141,7 +1141,7 @@ double BSpline::splineValue(double x, size_t k, unsigned int p, VEC_D& d, const } } - return d[p]; + return p < d.size() ? d[p] : 0.0; } void BSpline::setupFlattenedKnots()