Skip to content

Fix bounds checking in FlAccessibleTextField#188137

Merged
robert-ancell merged 1 commit into
flutter:masterfrom
robert-ancell:fix-accessible-text-field-bounds-checking
Jun 18, 2026
Merged

Fix bounds checking in FlAccessibleTextField#188137
robert-ancell merged 1 commit into
flutter:masterfrom
robert-ancell:fix-accessible-text-field-bounds-checking

Conversation

@robert-ancell

Copy link
Copy Markdown
Contributor

Add bounds validation to get_substring and get_string_at_offset to prevent out-of-bounds memory access when ATK clients pass offsets beyond the text length.

  • get_substring: clamp start and end to [0, length] and ensure start <= end before calling g_utf8_substring.
  • get_string_at_offset: clamp start and end to [0, n_attrs-1] before accessing the PangoLogAttr array.

Add tests for offset-beyond-end, empty text, and offset-at-end boundary conditions.

@robert-ancell
robert-ancell requested a review from a team as a code owner June 17, 2026 23:47
@flutter-dashboard flutter-dashboard Bot added the CICD Run CI/CD label Jun 17, 2026
@github-actions github-actions Bot added a: text input Entering text in a text field or keyboard related problems engine flutter/engine related. See also e: labels. platform-linux Building on or for Linux specifically a: desktop Running on desktop team-linux Owned by the Linux platform team labels Jun 17, 2026
Add bounds validation to get_substring and get_string_at_offset to
prevent out-of-bounds memory access when ATK clients pass offsets
beyond the text length.

- get_substring: clamp start and end to [0, length] and ensure
  start <= end before calling g_utf8_substring.
- get_string_at_offset: clamp start and end to [0, n_attrs-1] before
  accessing the PangoLogAttr array.

Add tests for offset-beyond-end, empty text, and offset-at-end
boundary conditions.
@robert-ancell
robert-ancell force-pushed the fix-accessible-text-field-bounds-checking branch from f3b0d5e to 9575ddf Compare June 17, 2026 23:49
@github-actions github-actions Bot removed the CICD Run CI/CD label Jun 17, 2026

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request introduces bounds checking to FlAccessibleTextField in the Linux platform shell. Specifically, it clamps the start and end offsets in get_substring and get_string_at_offset to prevent out-of-bounds access. Additionally, comprehensive unit tests are added to verify correct behavior under various edge cases, such as empty text and offsets beyond the text length. I have no feedback to provide.

@loic-sharma loic-sharma left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

@robert-ancell
robert-ancell enabled auto-merge June 18, 2026 01:28
@robert-ancell robert-ancell added the CICD Run CI/CD label Jun 18, 2026
@robert-ancell
robert-ancell added this pull request to the merge queue Jun 18, 2026
Merged via the queue into flutter:master with commit 1e36b1c Jun 18, 2026
200 of 201 checks passed
@robert-ancell
robert-ancell deleted the fix-accessible-text-field-bounds-checking branch June 18, 2026 03:46
auto-submit Bot pushed a commit to flutter/packages that referenced this pull request Jun 18, 2026
flutter/flutter@b10d0f1...15963bc

2026-06-18 [email protected] Roll Skia from 6e84902d56c3 to 1ae2466c9ea5 (4 revisions) (flutter/flutter#188172)
2026-06-18 [email protected] Roll Packages from 6ce00a8 to 4fd05e6 (3 revisions) (flutter/flutter#188171)
2026-06-18 [email protected] [Linux] Fix vertical offset in composite_layer (flutter/flutter#188145)
2026-06-18 [email protected] [Linux] Fix incorrect GL datatypes for uniform locations (flutter/flutter#188143)
2026-06-18 [email protected] Roll Dart SDK from e05c69222ea4 to 5883736e7670 (2 revisions) (flutter/flutter#188168)
2026-06-18 [email protected] Roll Skia from 046277850e8d to 6e84902d56c3 (5 revisions) (flutter/flutter#188165)
2026-06-18 [email protected] Roll Fuchsia Linux SDK from or21OEdGtairm6nl9... to 1E2qOlNnC2Ucn-1oV... (flutter/flutter#188162)
2026-06-18 [email protected] Roll Skia from 8dd207d443d3 to 046277850e8d (1 revision) (flutter/flutter#188153)
2026-06-18 [email protected] Add entitlements.txt entries for new dart sdk binaries (flutter/flutter#188133)
2026-06-18 [email protected] Roll Dart SDK from b670723c5f07 to e05c69222ea4 (1 revision) (flutter/flutter#188146)
2026-06-18 [email protected] Fix bounds checking in FlAccessibleTextField (flutter/flutter#188137)
2026-06-18 [email protected] Roll Skia from f5a2921fe23e to 8dd207d443d3 (2 revisions) (flutter/flutter#188141)
2026-06-18 [email protected] Adds tests for disabling macos impeller (flutter/flutter#188132)
2026-06-17 [email protected] Improve Flutter Web accessibility: update flt meta viewport tag to align with WCAG 2 guidelines (flutter/flutter#182047)
2026-06-17 [email protected] Roll Dart SDK from e39bde5b1bfc to b670723c5f07 (2 revisions) (flutter/flutter#188130)
2026-06-17 [email protected] Roll Skia from 066bfbac7282 to f5a2921fe23e (1 revision) (flutter/flutter#188128)
2026-06-17 [email protected] Support --trace-systrace in release builds on Android (flutter/flutter#186359)
2026-06-17 [email protected] Isolate compiled dill caches by TargetModel (flutter/flutter#187253)
2026-06-17 98614782+auto-submit[bot]@users.noreply.github.com Reverts "refactor(web): Unify Image on Skwasm and CanvasKit (#187873)" (flutter/flutter#188124)
2026-06-17 [email protected] Use a mock EGL manager in windows unittests to avoid flaky rendering calls (flutter/flutter#188078)
2026-06-17 [email protected] [Android] Remove support for unused manifest flags (flutter/flutter#186021)
2026-06-17 [email protected] Adds windows project switch for enabling impeller (flutter/flutter#188044)
2026-06-17 [email protected] Skip prefetch SwiftPM dependencies if the project hasn't been migrated to SwiftPM yet (flutter/flutter#187206)
2026-06-17 [email protected] [flutter_tools] Bump dwds to 27.1.2 (flutter/flutter#187951)
2026-06-17 [email protected] Adds external texture devicelab test for windows impeller (flutter/flutter#187886)
2026-06-17 [email protected] Roll Skia from 5d19002eb73e to 066bfbac7282 (2 revisions) (flutter/flutter#188118)
2026-06-17 [email protected] Add note about magnifier issue when using transparent HCPP pv (flutter/flutter#187753)
2026-06-17 [email protected] [linux]: fixes crash when resizing windows (flutter/flutter#187626)
2026-06-17 [email protected] [flutter_tools] Enforce that package-declared asset paths stay within the package (flutter/flutter#187661)
2026-06-17 [email protected] Remove canvaskit_cipd_instance from DEPS (flutter/flutter#188073)

If this roll has caused a breakage, revert this CL and stop the roller
using the controls here:
https://autoroll.skia.org/r/flutter-packages
Please CC [email protected],[email protected] on the revert to ensure that a human
is aware of the problem.

To file a bug in Packages: https://github.com/flutter/flutter/issues/new/choose

To report a problem with the AutoRoller itself, please file a bug:
https://issues.skia.org/issues/new?component=1389291&template=1850622

Documentation for the AutoRoller is here:
https://skia.googlesource.com/buildbot/+doc/main/autoroll/README.md
LouiseHsu pushed a commit to LouiseHsu/flutter that referenced this pull request Jun 18, 2026
Add bounds validation to get_substring and get_string_at_offset to
prevent out-of-bounds memory access when ATK clients pass offsets beyond
the text length.

- get_substring: clamp start and end to [0, length] and ensure start <=
end before calling g_utf8_substring.
- get_string_at_offset: clamp start and end to [0, n_attrs-1] before
accessing the PangoLogAttr array.

Add tests for offset-beyond-end, empty text, and offset-at-end boundary
conditions.
@loic-sharma loic-sharma added the cp: stable cherry pick this pull request to stable release candidate branch label Jun 18, 2026
via-guy pushed a commit to via-guy/flutter that referenced this pull request Jun 26, 2026
Add bounds validation to get_substring and get_string_at_offset to
prevent out-of-bounds memory access when ATK clients pass offsets beyond
the text length.

- get_substring: clamp start and end to [0, length] and ensure start <=
end before calling g_utf8_substring.
- get_string_at_offset: clamp start and end to [0, n_attrs-1] before
accessing the PangoLogAttr array.

Add tests for offset-beyond-end, empty text, and offset-at-end boundary
conditions.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

a: desktop Running on desktop a: text input Entering text in a text field or keyboard related problems CICD Run CI/CD cp: stable cherry pick this pull request to stable release candidate branch engine flutter/engine related. See also e: labels. platform-linux Building on or for Linux specifically team-linux Owned by the Linux platform team

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants