InputTextMultiline with ReadOnly flag: AddressSanitizer crash #6570

New issue

Closed

opened 2023-07-04 14:03:29 +00:00 by mizmar · 2 comments

mizmar commented

2023-07-04 14:03:29 +00:00

(Migrated from github.com)

Version/Branch of Dear ImGui: any of 1.89.6/master/docking
Back-end/Renderer/Compiler/OS:

Backend: tested on examples sdl2 + sdlrenderer2/opengl3
Compiler: g++ 11.3.0
Operating System: Ubuntu 22.04

My Issue:

Address sanitizer catches global-buffer-overflow inside InputTextMultiline with ReadOnly flag.
Happens when the text box loses focus (when I click in and out).

=================================================================
==30536==ERROR: AddressSanitizer: global-buffer-overflow on address 0x561d2ce7bfc1 at pc 0x7f6d6243a397 bp 0x7ffdcb998c30 sp 0x7ffdcb9983d8
READ of size 10 at 0x561d2ce7bfc1 thread T0
    #0 0x7f6d6243a396 in __interceptor_memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:827
    #1 0x561d2ccce3d2 in ImGui::InputTextDeactivateHook(unsigned int) ../../imgui_widgets.cpp:4056
    #2 0x561d2c98f9ad in ImGui::SetActiveID(unsigned int, ImGuiWindow*) ../../imgui.cpp:3827
    #3 0x561d2c990a9d in ImGui::ClearActiveID() ../../imgui.cpp:3868
    #4 0x561d2ccdc802 in ImGui::InputTextEx(char const*, char const*, char*, int, ImVec2 const&, int, int (*)(ImGuiInputTextCallbackData*), void*) ../../imgui_widgets.cpp:4752
    #5 0x561d2ccb5aec in ImGui::InputTextMultiline(char const*, char*, unsigned long, ImVec2 const&, int, int (*)(ImGuiInputTextCallbackData*), void*) ../../imgui_widgets.cpp:3626
    #6 0x561d2c94ed23 in main imgui/examples/example_sdl2_opengl3/main.cpp:173
    #7 0x7f6d61429d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
    #8 0x7f6d61429e3f in __libc_start_main_impl ../csu/libc-start.c:392
    #9 0x561d2c94e164 in _start (imgui/examples/example_sdl2_opengl3/example_sdl2_opengl3+0x5a7164)

0x561d2ce7bfc1 is located 0 bytes to the right of global variable '*.LC21' defined in '../../imgui_widgets.cpp' (0x561d2ce7bfc0) of size 1
  '*.LC21' is ascii string ''
==30536==ABORTING

Standalone, minimal, complete and verifiable example:

Modify any example, add window:

ImGui::Begin("test");

static char buf[4096] = "non-empty";

ImGui::InputTextMultiline("##source",
    buf, sizeof(buf),
    ImVec2(-FLT_MIN, -FLT_MIN),
    ImGuiInputTextFlags_ReadOnly);

ImGui::End();

Buffer can also be std::string, and static or not static. Error does not happen when content is empty string.

Issue seems to be in InputTextDeactivateHook(ImGuiID id). With ReadOnly flag the state->TextA.Data is null, but state->CurLenA is length of content string. The memcpy runs on constant string literal "" with inappropriate length.

**Version/Branch of Dear ImGui:** any of 1.89.6/master/docking **Back-end/Renderer/Compiler/OS**: Backend: tested on examples sdl2 + sdlrenderer2/opengl3 Compiler: g++ 11.3.0 Operating System: Ubuntu 22.04 **My Issue:** Address sanitizer catches global-buffer-overflow inside `InputTextMultiline` with **ReadOnly** flag. Happens when the text box loses focus (when I click in and out). ``` ================================================================= ==30536==ERROR: AddressSanitizer: global-buffer-overflow on address 0x561d2ce7bfc1 at pc 0x7f6d6243a397 bp 0x7ffdcb998c30 sp 0x7ffdcb9983d8 READ of size 10 at 0x561d2ce7bfc1 thread T0 #0 0x7f6d6243a396 in __interceptor_memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:827 #1 0x561d2ccce3d2 in ImGui::InputTextDeactivateHook(unsigned int) ../../imgui_widgets.cpp:4056 #2 0x561d2c98f9ad in ImGui::SetActiveID(unsigned int, ImGuiWindow*) ../../imgui.cpp:3827 #3 0x561d2c990a9d in ImGui::ClearActiveID() ../../imgui.cpp:3868 #4 0x561d2ccdc802 in ImGui::InputTextEx(char const*, char const*, char*, int, ImVec2 const&, int, int (*)(ImGuiInputTextCallbackData*), void*) ../../imgui_widgets.cpp:4752 #5 0x561d2ccb5aec in ImGui::InputTextMultiline(char const*, char*, unsigned long, ImVec2 const&, int, int (*)(ImGuiInputTextCallbackData*), void*) ../../imgui_widgets.cpp:3626 #6 0x561d2c94ed23 in main imgui/examples/example_sdl2_opengl3/main.cpp:173 #7 0x7f6d61429d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58 #8 0x7f6d61429e3f in __libc_start_main_impl ../csu/libc-start.c:392 #9 0x561d2c94e164 in _start (imgui/examples/example_sdl2_opengl3/example_sdl2_opengl3+0x5a7164) 0x561d2ce7bfc1 is located 0 bytes to the right of global variable '*.LC21' defined in '../../imgui_widgets.cpp' (0x561d2ce7bfc0) of size 1 '*.LC21' is ascii string '' ==30536==ABORTING ``` **Standalone, minimal, complete and verifiable example:** Modify any example, add window: ```cpp ImGui::Begin("test"); static char buf[4096] = "non-empty"; ImGui::InputTextMultiline("##source", buf, sizeof(buf), ImVec2(-FLT_MIN, -FLT_MIN), ImGuiInputTextFlags_ReadOnly); ImGui::End(); ``` Buffer can also be `std::string`, and static or not static. Error does not happen when content is empty string. Issue seems to be in `InputTextDeactivateHook(ImGuiID id)`. With **ReadOnly** flag the `state->TextA.Data` is null, but `state->CurLenA` is length of content string. The memcpy runs on constant string literal `""` with inappropriate length.

ocornut commented

2023-07-04 14:11:03 +00:00

(Migrated from github.com)

Thank you for reporting! This is a followup to #6292 #4714 (commits e8206db82, 5a2b1e848). Investigating now.

Thank you for reporting! This is a followup to #6292 #4714 (commits e8206db82, 5a2b1e848). Investigating now.

ocornut commented

2023-07-04 14:21:53 +00:00

(Migrated from github.com)

Turns out my fix e8206db was incorrect. That data is not used on ReadOnly fields. Pushed fix d4ddc46

Incidentally I was just about to tag 1.89.7 so this will go into it. Thanks!

Turns out my fix e8206db was incorrect. That data is not used on ReadOnly fields. Pushed fix d4ddc46 Incidentally I was just about to tag 1.89.7 so this will go into it. Thanks!

❤️ 1