InputTextMultiline with ReadOnly flag: AddressSanitizer crash

[mizmar]

Version/Branch of Dear ImGui: any of 1.89.6/master/docking
Back-end/Renderer/Compiler/OS:

Backend: tested on examples sdl2 + sdlrenderer2/opengl3
Compiler: g++ 11.3.0
Operating System: Ubuntu 22.04

My Issue:

Address sanitizer catches global-buffer-overflow inside InputTextMultiline with ReadOnly flag.
Happens when the text box loses focus (when I click in and out).

=================================================================
==30536==ERROR: AddressSanitizer: global-buffer-overflow on address 0x561d2ce7bfc1 at pc 0x7f6d6243a397 bp 0x7ffdcb998c30 sp 0x7ffdcb9983d8
READ of size 10 at 0x561d2ce7bfc1 thread T0
    #0 0x7f6d6243a396 in __interceptor_memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:827
    #1 0x561d2ccce3d2 in ImGui::InputTextDeactivateHook(unsigned int) ../../imgui_widgets.cpp:4056
    #2 0x561d2c98f9ad in ImGui::SetActiveID(unsigned int, ImGuiWindow*) ../../imgui.cpp:3827
    #3 0x561d2c990a9d in ImGui::ClearActiveID() ../../imgui.cpp:3868
    #4 0x561d2ccdc802 in ImGui::InputTextEx(char const*, char const*, char*, int, ImVec2 const&, int, int (*)(ImGuiInputTextCallbackData*), void*) ../../imgui_widgets.cpp:4752
    #5 0x561d2ccb5aec in ImGui::InputTextMultiline(char const*, char*, unsigned long, ImVec2 const&, int, int (*)(ImGuiInputTextCallbackData*), void*) ../../imgui_widgets.cpp:3626
    #6 0x561d2c94ed23 in main imgui/examples/example_sdl2_opengl3/main.cpp:173
    #7 0x7f6d61429d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
    #8 0x7f6d61429e3f in __libc_start_main_impl ../csu/libc-start.c:392
    #9 0x561d2c94e164 in _start (imgui/examples/example_sdl2_opengl3/example_sdl2_opengl3+0x5a7164)

0x561d2ce7bfc1 is located 0 bytes to the right of global variable '*.LC21' defined in '../../imgui_widgets.cpp' (0x561d2ce7bfc0) of size 1
  '*.LC21' is ascii string ''
==30536==ABORTING

Standalone, minimal, complete and verifiable example:

Modify any example, add window:

ImGui::Begin("test");

static char buf[4096] = "non-empty";

ImGui::InputTextMultiline("##source",
    buf, sizeof(buf),
    ImVec2(-FLT_MIN, -FLT_MIN),
    ImGuiInputTextFlags_ReadOnly);

ImGui::End();

Buffer can also be std::string, and static or not static. Error does not happen when content is empty string.

Issue seems to be in InputTextDeactivateHook(ImGuiID id). With ReadOnly flag the state->TextA.Data is null, but state->CurLenA is length of content string. The memcpy runs on constant string literal "" with inappropriate length.

[ocornut]

Thank you for reporting! This is a followup to #6292 #4714 (commits e8206db, 5a2b1e8). Investigating now.

[ocornut]

Turns out my fix e8206db was incorrect. That data is not used on ReadOnly fields. Pushed fix d4ddc46

Incidentally I was just about to tag 1.89.7 so this will go into it. Thanks!