Skip to content

fix: correct input text selection adjustment logic in InputTextEx - #5

Open
nopjmp wants to merge 1 commit into
goatcorp:1.88-enhanced-abifixfrom
nopjmp:fix/inputtextex-access-violation
Open

nopjmp wants to merge 1 commit into
goatcorp:1.88-enhanced-abifixfrom
nopjmp:fix/inputtextex-access-violation

Conversation

@nopjmp

@nopjmp nopjmp commented Aug 30, 2026 •

Copy link
Copy Markdown

Observed in a crash in Wolsit (Dalamud.FindAnything). The allocation for the input landed on a page boundary which caused an access violation.

Review the backtrace, I found that the condition was pointing at the wrong searches_input_ptr slot which caused an out of bounds read on *(searches_input_ptr[1] - 1)

Exception Info #0
Address: C0000005
Flags: 0
Address: 7FFDC818BB3A
Parameters: 0, 1611C9D2FFE
Thread: 0x6520
Call Stack
{
  [0]	cimgui.dll+BBB3A	(igCustom_WindowSetInheritNoInputs+0xA724A)
  [1]	cimgui.dll+12C35	(igInputTextEx+0x35)
  [2]	Dalamud.Bindings.ImGui.ImGui.InputTextWithHint(Dalamud.Bindings.ImGui.ImU8String, Dalamud.Bindings.ImGui.ImU8String, System.String ByRef, Int32, Dalamud.Bindings.ImGui.ImGuiInputTextFlags, ImGuiInputTextCallbackDelegate)
  [3]	Dalamud.FindAnything.Finder.DrawFinder(Boolean ByRef)
  [4]	Dalamud.FindAnything.Finder.Draw()
  [5]	Dalamud.Interface.Windowing.WindowHost.DrawInternal(WindowDrawParameters, Dalamud.Interface.Windowing.Persistence.WindowSystemPersistence)
  [6]	Dalamud.Interface.Windowing.WindowSystem.Draw()
  [7]	Dalamud.Interface.UiBuilder.OnDraw()
  [8]	ILStubClass.IL_STUB_MulticastDelegate_Invoke()
  [9]	Dalamud.Interface.Internal.InterfaceManager.Display()
  [10]	Dalamud.Interface.Internal.InterfaceManager.DxgiSwapChainPresentDetour(TerraFX.Interop.DirectX.IDXGISwapChain*, UInt32, UInt32)
  [11]	ILStubClass.IL_STUB_ReversePInvoke(TerraFX.Interop.DirectX.IDXGISwapChain*, UInt32, UInt32)
  [12]	ffxiv_dx11.exe+21B442	(Client::Graphics::Kernel::SwapChain.Present+0x1E2)
  [13]	ffxiv_dx11.exe+226C89	(Client::Graphics::Kernel::DeviceDX11.PostTick+0x719)
  [14]	ffxiv_dx11.exe+D1C05	(Client::System::Framework::Framework.Tick+0x385)
  [15]	ILStubClass.IL_STUB_PInvoke(FFXIVClientStructs.FFXIV.Client.System.Framework.Framework*)
  [16]	ILStubClass.IL_STUB_ReversePInvoke(FFXIVClientStructs.FFXIV.Client.System.Framework.Framework*)
  [17]	ffxiv_dx11.exe+5BAB5	(sub_14005B940+0x175)
  [18]	ffxiv_dx11.exe+5EFE5	(WinMain+0x1355)
  [19]	ffxiv_dx11.exe+1D9818E	(__scrt_common_main_seh+0x106)
  [20]	KERNEL32.DLL+2CCB7	(BaseThreadInitThunk+0x17)
  [21]	ntdll.dll+ACAEC	(RtlUserThreadStart+0x2C)
}

WinDBG

  *** Stack trace for last set context - .thread/.cxr resets it
 # Child-SP          RetAddr               : Args to Child                                                           : Call Site
00 00000014`6b4f32a0 00007ffd`c80e2c35     : 00000000`00000000 00000014`6b4f3f30 00000014`6b4f3e80 00000014`6b4f6f30 : cimgui!ImGui::InputTextEx+0x37ca [D:\a\Dalamud\Dalamud\lib\cimgui\imgui\imgui_widgets.cpp @ 4735] 
01 00000014`6b4f35b0 00007ffd`7869472b     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : cimgui!igInputTextEx+0x35 [D:\a\Dalamud\Dalamud\lib\cimgui\cimgui.cpp @ 4954] 
02 00000014`6b4f3600 00007ffd`fac322a9     : 00000147`f7863dd8 00000147`43e40000 00000014`6b4f75a8 00000000`00000000 : Dalamud_Bindings_ImGui!Dalamud.Bindings.ImGui.ImGui.InputTextWithHint(Dalamud.Bindings.ImGui.ImU8String, Dalamud.Bindings.ImGui.ImU8String, System.String ByRef, Int32, Dalamud.Bindings.ImGui.ImGuiInputTextFlags, ImGuiInputTextCallbackDelegate)+0x930fb [D:\a\Dalamud\Dalamud\imgui\Dalamud.Bindings.ImGui\Custom\ImGui.Manual.cs @ 541] 
03 00000014`6b4f3e90 00007ffd`fac31c44     : 00000147`c62f9ef0 00000014`6b4f78d8 00000000`3f800000 00000000`00000000 : Dalamud_FindAnything!Dalamud.FindAnything.Finder.DrawFinder()+0x529*** WARNING: Unable to verify checksum for Dalamud.FindAnything.dll

04 00000014`6b4f7670 00007ffd`785769f7     : 00000147`c62f9ef0 00000147`c630db08 00000000`00000000 00007ffd`6dab53e8 : Dalamud_FindAnything!Dalamud.FindAnything.Finder.Draw()+0x44
05 00000014`6b4f7900 00007ffd`7857adb8     : 00000147`c630db08 00000014`6b4fa5d8 00000147`b162bad8 00000014`6b4fa2e0 : Dalamud!Dalamud.Interface.Windowing.WindowHost.DrawInternal(WindowDrawParameters, Dalamud.Interface.Windowing.Persistence.WindowSystemPersistence)+0x7bcded7 [/_/Dalamud/Interface/Windowing/WindowHost.cs @ 348] 
06 00000014`6b4f9fe0 00007ffd`7857915a     : 00000147`c62fc9b8 00000000`00000000 00000000`00000000 00000000`00000000 : Dalamud!Dalamud.Interface.Windowing.WindowSystem.Draw()+0x7bd4298 [/_/Dalamud/Interface/Windowing/WindowSystem.cs @ 137] 
07 00000014`6b4fa660 00007ffd`6e845bf4     : 00000147`c2f927d0 00000000`00000000 00000000`00000000 00000000`00000000 : Dalamud!Dalamud.Interface.UiBuilder.OnDraw()+0x7bc8dca [/_/Dalamud/Interface/UiBuilder.cs @ 790] 
08 00000014`6b4fa720 00007ffd`7859c61f     : 00000160`d83fc860 00007ffe`560d3198 0000015f`c98b6d60 00000000`00000001 : Dalamud!ILStubClass.IL_STUB_MulticastDelegate_Invoke()+0x34
09 00000014`6b4fa760 00007ffd`78596705     : 00000147`b17e9f88 00000147`bb6eb398 00000147`bb6eb398 00000000`00000000 : Dalamud!Dalamud.Interface.Internal.InterfaceManager.Display()+0x7c00a1f [/_/Dalamud/Interface/Internal/InterfaceManager.cs @ 1257] 
0a 00000014`6b4fa810 00007ffd`7094ffad     : 00000147`b17e9f88 00000000`00000001 00000000`00000000 00000000`00000000 : Dalamud!Dalamud.Interface.Internal.InterfaceManager.DxgiSwapChainPresentDetour(TerraFX.Interop.DirectX.IDXGISwapChain*, UInt32, UInt32)+0x7c46715 [/_/Dalamud/Interface/Internal/InterfaceManager.AsHook.cs @ 99] 
0b 00000014`6b4fa990 00007ff6`7ddcb442     : 00000051`d73e667c 0000015f`00000000 ffffffff`ffffd8f0 00000000`00000001 : Dalamud!ILStubClass.IL_STUB_ReversePInvoke(TerraFX.Interop.DirectX.IDXGISwapChain*, UInt32, UInt32)+0x4d
0c 00000014`6b4faa00 00007ff6`7ddd6c89     : 00000000`00000000 00000000`00000010 0000015f`e1f1f540 00000014`6b4fed88 : ffxiv_dx11+0x21b442
0d 00000014`6b4faab0 00007ff6`7dc81c05     : 0000015f`00000000 0000015f`c2432080 00000014`6b4feed0 0000015f`c2432080 : ffxiv_dx11+0x226c89
0e 00000014`6b4fee10 00007ffd`6c7059cc     : 00000051`3c8e80cc 00000000`00000000 00000000`00000000 00000000`00000000 : ffxiv_dx11+0xd1c05
0f 00000014`6b4fee40 00007ffd`7088b0bf     : 0000015f`c2432080 00007ffd`6e2b2960 0000024c`0000070a 00007ff6`804a1880 : Dalamud!ILStubClass.IL_STUB_PInvoke(FFXIVClientStructs.FFXIV.Client.System.Framework.Framework*)+0x5c
10 00000014`6b4feee0 00007ff6`7dc0bab5     : 00000000`00000008 00000000`00000008 00000000`00000001 00000000`00000001 : Dalamud!ILStubClass.IL_STUB_ReversePInvoke(FFXIVClientStructs.FFXIV.Client.System.Framework.Framework*)+0x3f
11 00000014`6b4fef40 00007ff6`7dc0efe5     : 00000014`6b4ff0b0 00000000`000002f7 00000000`00000001 00000000`00000001 : ffxiv_dx11+0x5bab5
12 00000014`6b4fefb0 00007ff6`7f94818e     : 00000000`0000000a 00000000`0000000a 00000000`00000000 00000000`00000000 : ffxiv_dx11+0x5efe5
13 00000014`6b4ff950 00007ffe`ff28ccb7     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ffxiv_dx11+0x1d9818e
14 00000014`6b4ff990 00007ffe`ffeecaec     : 00000000`00000000 00000000`00000000 000004f0`fffffb30 000004d0`fffffb30 : kernel32!BaseThreadInitThunk+0x17
15 00000014`6b4ff9c0 00000000`00000000     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!RtlUserThreadStart+0x2c

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant