Blender

Recent Commits

• Tariq-Sulley(25 Oct 26)

  Fix #123968: Rip and Rip fill tools don't support "Redo" The rip operator previously executed its logic in `invoke()`. As a result, changing values in the redo panel did not re-run the operation correctly. Now move the core logic to an `exec()` function to allow redo work correctly. Pull Request: https://projects.blender.org/blender/blender/pulls/147005 --------- Co-authored-by: Campbell Barton <[email protected]> Co-authored-by: Xury Greer <[email protected]>

• Aras Pranckevicius(25 Oct 26)

  Merge branch 'blender-v5.3-release'

• Aras Pranckevicius(25 Oct 26)

  Fix #161474: Compositor effect that produces smaller image wrongly occludes other strips Code that was determining whether a compositor effect is fully opaque was not taking into account that while the compositor result itself can be fully opaque, it might be of different size or have a translation offset compared to regular VSE frame. Pull Request: https://projects.blender.org/blender/blender/pulls/165625

• Mark van de Ruit(25 Oct 26)

  Merge branch 'blender-v5.3-release'

• Mark van de Ruit(25 Oct 26)

  Fix: GSplat: Remove `static` in function-scoped constexpr shader variable

• Campbell Barton(25 Oct 26)

  Merge branch 'blender-v5.3-release'

• Campbell Barton(25 Oct 26)

  Merge branch 'blender-v5.3-release'

• Campbell Barton(25 Oct 26)

  Merge branch 'blender-v5.3-release'

• Campbell Barton(25 Oct 26)

  Fix: unescaped custom property names in library override RNA paths Names containing quotes or back-slashes created invalid paths. Ref !165630

• Campbell Barton(25 Oct 26)

  Fix: stack overflow assigning swizzles to vectors over 4 dimensions The whole vector was copied into a 4 element buffer, only copy the values swizzle axes can access. Ref !165631

• Campbell Barton(25 Oct 26)

  Fix: heap overflow in Vector.resized() when shrinking The new vector was sized from the requested length but the copy used the length of the original vector. Ref !165631

• Campbell Barton(25 Oct 26)

  Fix: off-by-one write in strbuf_append_path for recursive file-ops The allocated size included the nil terminator but was compared against the length without it, so a joined path of exactly FILE_MAX wrote past the buffer (release builds only). Ref !165633

• Campbell Barton(24 Oct 26)

  Fix: unbounded copy into a fixed buffer shortening UNC paths (WIN32) The temporary buffer isn't needed: removing the prefix only ever shortens the path, so the remaining text can be modified in-place. Also add tests for BLI_path_normalize_unc. Ref !165633

• Campbell Barton(24 Oct 26)

  Fix: unescaped node group name in Python expression when swapping nodes Regression in [0] which removed string escaping. Use RNA_path_full_ID_py which escapes the name and includes the library for linked node groups. [0]: 2a1a658492f50c3842b95b32fd9f89438ab7de17 Ref !165630

• Campbell Barton(24 Oct 26)

  Fix: unescaped bone & shape key names in FBX/USD imported animation paths Names containing quotes or back-slashes created F-curves that didn't resolve. Ref !165630

• Campbell Barton(24 Oct 26)

  Fix: unescaped modifier name versioning Geometry Nodes input paths Animation, drivers & overrides on inputs of modifiers with names containing quotes or back-slashes weren't moved to the new property paths. Ref !165630

• Campbell Barton(24 Oct 26)

  Fix: stack buffer overflow regression comparing long override RNA paths Regression in [0] for paths too long for the stack buffer. The resulting string was read from uninitialized memory & memory leaked. [0]: f04bc75f8ce0dbef36f440ff3f840c54de9fda12 Ref !165631

• Campbell Barton(24 Oct 26)

  Fix: assignment instead of comparison in RNA_property_boolean_set_array In debug builds the ID-property type was overwritten instead of checked. Ref !165631

• Campbell Barton(24 Oct 26)

  Fix: BLI_path_parent_dir_end not skipping "/./" A typo (`*p - 2` instead of `*(p - 2)`) meant the check never succeeded. Also correct the bounds check (`p + 1 > path` -> `p - 1 > path`), so matching "/." can't step before the start of `path`. Ref !165631

• Campbell Barton(24 Oct 26)

  Fix: BLI_strncat clearing the destination with WITH_STRSIZE_DEBUG Use BLI_string_debug_size_after_nil since the existing string is kept. Ref !165631

• Campbell Barton(24 Oct 26)

  Fix: memory leak in BLI_path_normalize_unc (WIN32) Ref !165631

• Campbell Barton(25 Oct 26)

  Fix: potential buffer overflow in RNA_property_string_get_default Use string copy that respects the buffer size, UTF8 preserving where appropriate. Also use direct null-byte assignment instead of strcpy for an empty string. Ref !165631

• Campbell Barton(25 Oct 26)

  Fix: bytes StringProperty set_transform storing data read past the input RNA_property_string_set_bytes copied from the original value using the length of the transformed value. Ref !165631

• Campbell Barton(24 Oct 26)

  Fix: out-of-bounds cursor typing over a text selection When the text was full or an accent was applied, the selection was removed as if a character had been inserted, moving the cursor past the end of the text. Ref !165633

• Campbell Barton(24 Oct 26)

  Fix: out-of-bounds read in BLI_str_format_byte_unit_compact Sizes of 100 PB or more indexed past the end of the units array, add the "E" unit (Exabyte) to avoid this. Ref !165633

• Campbell Barton(24 Oct 26)

  Fix: out-of-bounds read in BLI_strnlen_utf8_ex The byte at `strc_maxlen` was read when there was no nil before it. Ref !165633

• Campbell Barton(24 Oct 26)

  Fix: out-of-bounds read in BLI_str_unescape with a trailing back-slash When the range ended with a back-slash, the byte after the range was read and could be used as the escaped character. Ref !165630

• Campbell Barton(24 Oct 26)

  Fix: out-of-bounds access in BLI_strncpy_ensure_pad for small buffers Sizes below 3 could read before `src` or write past `dst`. Also correct the doc-string. Ref !165633

• Campbell Barton(24 Oct 26)

  Fix: out-of-bounds pointer from BLI_str_find_prev_char_utf8 With only continuation bytes before the position, the pointer before str_start was returned. While this wont typically happen for valid UTF8, it shouldn't be possible under any circumstances. Ref !165633

• Campbell Barton(24 Oct 26)

  Fix: out-of-bounds write in BLI_str_escape When the output was truncated the nil terminator was written one byte past dst_maxncpy. Ref !165630