This bug is reproduced only on Linux. It was tested on Ubuntu, Debian, Arch. The interesting thing is that if we build Blender by our own, crash disappears. Probably, some issues with Linux libraries?

I’m on linux too… But again, the issue is not in the crash itself - a corrupted file is likely to crash sooner or later. I need to know how to generate such a corrupted file, otherwise there’s nothing we can do.

Thanks for your answer. Unfortunately the problem is not just with the single corrupted file. Some of Blend4Web demos are affected too. In Blend4Web SDK we have hundreds of files, so it would be very helpful to have some method to know if the file is corrupted or not, and another method to fix the issue. Our guys will look at this in details, but I fear some really bad things just have happened.

Knowing if the file is corrupted is pretty simple (assuming it has similar corruption to the one you posted here): just build a debug version of Blender with asan enabled (on linux or OSX, using gcc or clang, see http://wiki.blender.org/index.php/Dev:Doc/Tools/Debugging/GCC_Address_Sanitizer), it will crash on loading the file (complaining about reading past allocated memory or so iirc).

Thank you for your help. By using custom Blender build and simple script we have discovered approx. 10 corrupted scenes. Now we are looking for solution to fix them. Anyway, is it possible to perform (implement) an automatic validation for loaded/saved data in the future?

The thing is, such corruption should *never* happens, we cannot check for validity (as in, length of data arrays etc.) of data chunks in .blend file when loading, would be heavy and not much helpful.

The bug here is the generation of such corrupted file - if you cannot give us a way to reproduce that, afraid we can’t do anything… :/

The new attached file has no asan messages when opened. After the steps bellow, asan shows heap-buffer-overflow.

1. open .blend
2. run the script
3. save the file
4. reopen the file
5. run the script again
6. save the file again
7. Try to reopen. I have heap-buffer-overflow

script:

import bpy

d = bpy.data.objects['sunglasses'].data
d.calc_normals_split()

Has been hard, but found the issue. It’s not really related to lnors actually, it was a bug hidden deep in how cd layers are saved (written) - basically, when temp/nofree layers were removed for saving, mesh would still write org number of layers, instead of updated (reduced) new one…

Note that fix will solve corruption of data itself, but cannot do anything for files already broken. :|

Anyway, thanks a bunch for the report!

It works! Thank you!

In the interests of partial recovery of corrupted files, is it possible to abort loading of corrupted data blocks, such that only unmodified assets are loaded?

As I understand, aborting of any block loading is impossible because you can't know the offset of the next block without reading of previous block. And even if it is possible, generally, there is a non trivial issue to avoid broken links.