Opened 15 months ago
Closed 15 months ago
#14584 closed defect (fixed)
GUI: EditableWidget: Out-of-bounds read and failed assertion after using backspace/delete
Reported by: | PushmePullyu | Owned by: | PushmePullyu |
---|---|---|---|
Priority: | normal | Component: | GUI |
Version: | Keywords: | ||
Cc: | PushmePullyu | Game: |
Description
Tested with a2dc896ba6f29ecabc4b3795732522113b1623bf on Linux x86_64.
After deleting a character in an EditableWidget using either the backspace or delete key the now invalid selection is not cleared.
This results in out-of-bounds reads in EditTextWidget::drawWidget(), where _selCaretPos and _selOffset are used as offsets, and in a failed assertion when calling EditableWidget::defaultKeyDownHandler():
gui/widgets/editable.cpp:566: bool GUI::EditableWidget::setCaretPos(int): Assertion `newPos >= 0 && newPos <= (int)_editString.size()' failed.
To reproduce for the backspace key:
- In the ScummVM main menu, select a game and choose "Game Options..."
- Click on the ID field to edit it and move the caret after the end of the text either by clicking or by using the cursor keys
- Hold shift and press cursor right to set _selCaretPos
- Press backspace one or more times; the ID field should now contain some random characters from the OOB read
- Press the 'a' key to trigger a failed assertion
To reproduce for the delete key:
- In the ScummVM main menu, select a game and choose "Game Options..."
- Click on the ID field to edit it and move the caret after the end of the text either by clicking or by using the cursor keys
- Hold shift and press cursor left a few times to create a selection
- Press delete one or more times; the ID field should now contain some random characters from the OOB read
- Press the 'a' key to trigger a failed assertion
Change History (3)
comment:1 by , 15 months ago
Owner: | set to |
---|---|
Resolution: | → pending |
Status: | new → pending |
comment:3 by , 15 months ago
Resolution: | pending → fixed |
---|---|
Status: | pending → closed |
Note:
See TracTickets
for help on using tickets.
PR with fix: https://github.com/scummvm/scummvm/pull/5281