Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix null deref with y_offset in nk_group and nk_listview #584

Open
wants to merge 4 commits into
base: master
Choose a base branch
from
Open

Fix null deref with y_offset in nk_group and nk_listview #584

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
c6d5ca1
Fix null deref in nk_group_scrolled_offset_begin
mtijanic Oct 30, 2023
b0ec2cb
Fix other instances of same null deref pattern with y_offset
mtijanic Nov 3, 2023
3e7c372
Apply y_offset nullptr deref fix to src/ as well
mtijanic Nov 3, 2023
6af0db2
Changelog update for more accurate description of the y_offset nullpt…
mtijanic Nov 3, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion clib.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{
"name": "nuklear",
"version": "4.10.6",
"version": "4.10.7",
"repo": "Immediate-Mode-UI/Nuklear",
"description": "A small ANSI C gui toolkit",
"keywords": ["gl", "ui", "toolkit"],
Expand Down
41 changes: 37 additions & 4 deletions nuklear.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22827,7 +22827,15 @@ nk_group_begin_titled(struct nk_context *ctx, const char *id,
NK_ASSERT(y_offset);
if (!x_offset || !y_offset) return 0;
*x_offset = *y_offset = 0;
} else y_offset = nk_find_value(win, id_hash+1);
} else {
y_offset = nk_find_value(win, id_hash+1);
if (!y_offset) {
y_offset = nk_add_value(ctx, win, id_hash+1, 0);
NK_ASSERT(y_offset);
if (!y_offset) return 0;
*y_offset = 0;
}
}
Comment on lines +22830 to +22838
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good find, thanks a lot. Two things...

  1. Make sure to update the change in the src directory too. Otherwise the next time the paq.sh file is run, we'll lose this change.
  2. Also, what do you think about updating this pattern in both nuklear_group.c and nuklear_list_view.c too? Could probably run into the same issue there, as it's using a similar pattern.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

  1. Ah, right, sorry! I just ported the change from the vendored file in my project, I didn't read up on how development actually goes here. Sorry. Do I need to also edit nuklear.h or will that be handled automatically when you pack it up?
  2. Yep, seems similar. Do you want the same change there as well, or do you have some nicer way to generalize it in mind?

Thanks!

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

  1. No need to appologize. Can be confusing. You don't absolutely need to edit nuklear.h. Anyone can run the script and it'll get updated eventually. Whichever is easier for you
  2. Same way is fine 🤷

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done. I left it as smaller commits, but let me know if you prefer a squash. Or just squash when merging.

return nk_group_scrolled_offset_begin(ctx, x_offset, y_offset, title, flags);
}
NK_API nk_bool
Expand Down Expand Up @@ -22869,7 +22877,15 @@ nk_group_get_scroll(struct nk_context *ctx, const char *id, nk_uint *x_offset, n
NK_ASSERT(y_offset_ptr);
if (!x_offset_ptr || !y_offset_ptr) return;
*x_offset_ptr = *y_offset_ptr = 0;
} else y_offset_ptr = nk_find_value(win, id_hash+1);
} else {
y_offset_ptr = nk_find_value(win, id_hash+1);
if (!y_offset_ptr) {
y_offset_ptr = nk_add_value(ctx, win, id_hash+1, 0);
NK_ASSERT(y_offset_ptr);
if (!y_offset_ptr) return;
*y_offset_ptr = 0;
}
}
if (x_offset)
*x_offset = *x_offset_ptr;
if (y_offset)
Expand Down Expand Up @@ -22904,7 +22920,15 @@ nk_group_set_scroll(struct nk_context *ctx, const char *id, nk_uint x_offset, nk
NK_ASSERT(y_offset_ptr);
if (!x_offset_ptr || !y_offset_ptr) return;
*x_offset_ptr = *y_offset_ptr = 0;
} else y_offset_ptr = nk_find_value(win, id_hash+1);
} else {
y_offset_ptr = nk_find_value(win, id_hash+1);
if (!y_offset_ptr) {
y_offset_ptr = nk_add_value(ctx, win, id_hash+1, 0);
NK_ASSERT(y_offset_ptr);
if (!y_offset_ptr) return;
*y_offset_ptr = 0;
}
}
*x_offset_ptr = x_offset;
*y_offset_ptr = y_offset;
}
Expand Down Expand Up @@ -22954,7 +22978,15 @@ nk_list_view_begin(struct nk_context *ctx, struct nk_list_view *view,
NK_ASSERT(y_offset);
if (!x_offset || !y_offset) return 0;
*x_offset = *y_offset = 0;
} else y_offset = nk_find_value(win, title_hash+1);
} else {
y_offset = nk_find_value(win, title_hash+1);
if (!y_offset) {
y_offset = nk_add_value(ctx, win, title_hash+1, 0);
NK_ASSERT(y_offset);
if (!y_offset) return 0;
*y_offset = 0;
}
}
view->scroll_value = *y_offset;
view->scroll_pointer = y_offset;

Expand Down Expand Up @@ -29709,6 +29741,7 @@ nk_tooltipfv(struct nk_context *ctx, const char *fmt, va_list args)
/// - [y]: Minor version with non-breaking API and library changes
/// - [z]: Patch version with no direct changes to the API
///
/// - 2023/11/03 (4.10.7) - Fix null pointer dereference with nk_group and nk_listview scroll offsets
/// - 2022/12/23 (4.10.6) - Fix incorrect glyph index in nk_font_bake()
/// - 2022/12/17 (4.10.5) - Fix nk_font_bake_pack() using TTC font offset incorrectly
/// - 2022/10/24 (4.10.4) - Fix nk_str_{append,insert}_str_utf8 always returning 0
Expand Down
1 change: 1 addition & 0 deletions src/CHANGELOG
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@
/// - [y]: Minor version with non-breaking API and library changes
/// - [z]: Patch version with no direct changes to the API
///
/// - 2023/11/03 (4.10.7) - Fix null pointer dereference with nk_group and nk_listview scroll offsets
/// - 2022/12/23 (4.10.6) - Fix incorrect glyph index in nk_font_bake()
/// - 2022/12/17 (4.10.5) - Fix nk_font_bake_pack() using TTC font offset incorrectly
/// - 2022/10/24 (4.10.4) - Fix nk_str_{append,insert}_str_utf8 always returning 0
Expand Down
30 changes: 27 additions & 3 deletions src/nuklear_group.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -153,7 +153,15 @@ nk_group_begin_titled(struct nk_context *ctx, const char *id,
NK_ASSERT(y_offset);
if (!x_offset || !y_offset) return 0;
*x_offset = *y_offset = 0;
} else y_offset = nk_find_value(win, id_hash+1);
} else {
y_offset = nk_find_value(win, id_hash+1);
if (!y_offset) {
y_offset = nk_add_value(ctx, win, id_hash+1, 0);
NK_ASSERT(y_offset);
if (!y_offset) return 0;
*y_offset = 0;
}
}
return nk_group_scrolled_offset_begin(ctx, x_offset, y_offset, title, flags);
}
NK_API nk_bool
Expand Down Expand Up @@ -195,7 +203,15 @@ nk_group_get_scroll(struct nk_context *ctx, const char *id, nk_uint *x_offset, n
NK_ASSERT(y_offset_ptr);
if (!x_offset_ptr || !y_offset_ptr) return;
*x_offset_ptr = *y_offset_ptr = 0;
} else y_offset_ptr = nk_find_value(win, id_hash+1);
} else {
y_offset_ptr = nk_find_value(win, id_hash+1);
if (!y_offset_ptr) {
y_offset_ptr = nk_add_value(ctx, win, id_hash+1, 0);
NK_ASSERT(y_offset_ptr);
if (!y_offset_ptr) return;
*y_offset_ptr = 0;
}
}
if (x_offset)
*x_offset = *x_offset_ptr;
if (y_offset)
Expand Down Expand Up @@ -230,7 +246,15 @@ nk_group_set_scroll(struct nk_context *ctx, const char *id, nk_uint x_offset, nk
NK_ASSERT(y_offset_ptr);
if (!x_offset_ptr || !y_offset_ptr) return;
*x_offset_ptr = *y_offset_ptr = 0;
} else y_offset_ptr = nk_find_value(win, id_hash+1);
} else {
y_offset_ptr = nk_find_value(win, id_hash+1);
if (!y_offset_ptr) {
y_offset_ptr = nk_add_value(ctx, win, id_hash+1, 0);
NK_ASSERT(y_offset_ptr);
if (!y_offset_ptr) return;
*y_offset_ptr = 0;
}
}
*x_offset_ptr = x_offset;
*y_offset_ptr = y_offset;
}
10 changes: 9 additions & 1 deletion src/nuklear_list_view.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,15 @@ nk_list_view_begin(struct nk_context *ctx, struct nk_list_view *view,
NK_ASSERT(y_offset);
if (!x_offset || !y_offset) return 0;
*x_offset = *y_offset = 0;
} else y_offset = nk_find_value(win, title_hash+1);
} else {
y_offset = nk_find_value(win, title_hash+1);
if (!y_offset) {
y_offset = nk_add_value(ctx, win, title_hash+1, 0);
NK_ASSERT(y_offset);
if (!y_offset) return 0;
*y_offset = 0;
}
}
view->scroll_value = *y_offset;
view->scroll_pointer = y_offset;

Expand Down