imgui_software_renderer icon indicating copy to clipboard operation
imgui_software_renderer copied to clipboard

Out of bounds access in paint_uniform_rectangle

Open KasumiArai opened this issue 3 years ago • 1 comments

I put together the imgui demo containing ImGui::ShowDemoWindow() (the same imgui commit contained in third_party) with this software renderer, and had a consistent crash when opening Widgets, Color/Picker Widgets in the demo window. The Windows 10 window size was 889x528. The position and size of the demo window (as reported by imgui.ini): [Window][ImGui Demo] Pos=75,38 Size=691,3418 Collapsed=0

I believe I traced the issue to this line: https://github.com/emilk/imgui_software_renderer/blob/e942aca8f4352471217e0041c6c0d35f45a07fc2/src/imgui_sw.cpp#L239 max_y_i and min_y_i were both 528. That would prevent the for loops from drawing a row, but the last_target_pixel line still accessed memory beforehand. To fix, I set last_target_pixel to 0, as was done here: https://github.com/emilk/imgui_software_renderer/blob/e942aca8f4352471217e0041c6c0d35f45a07fc2/src/imgui_sw.cpp#L432

Apologies if a pull request might have been preferred. I was not sure if I should do so unsolicited.

Thanks for putting this together, it has been a massive help for a certain project of mine

KasumiArai avatar Jan 20 '22 11:01 KasumiArai

The problem is that paint_uniform_rectangle needs an early-out before indexing into target.pixels:

if (max_x_i <= min_x_i || max_y_i <= min_y_i) {
    return;
}

emilk avatar Jan 21 '22 09:01 emilk