Skip to content

Fix bounds checking in FlAccessibleTextField#188137

Merged
robert-ancell merged 1 commit into
flutter:masterfrom
robert-ancell:fix-accessible-text-field-bounds-checking
Jun 18, 2026
Merged

Fix bounds checking in FlAccessibleTextField#188137
robert-ancell merged 1 commit into
flutter:masterfrom
robert-ancell:fix-accessible-text-field-bounds-checking

Conversation

@robert-ancell

Copy link
Copy Markdown
Contributor

Add bounds validation to get_substring and get_string_at_offset to prevent out-of-bounds memory access when ATK clients pass offsets beyond the text length.

  • get_substring: clamp start and end to [0, length] and ensure start <= end before calling g_utf8_substring.
  • get_string_at_offset: clamp start and end to [0, n_attrs-1] before accessing the PangoLogAttr array.

Add tests for offset-beyond-end, empty text, and offset-at-end boundary conditions.

@robert-ancell robert-ancell requested a review from a team as a code owner June 17, 2026 23:47
@flutter-dashboard flutter-dashboard Bot added the CICD Run CI/CD label Jun 17, 2026
@github-actions github-actions Bot added a: text input Entering text in a text field or keyboard related problems engine flutter/engine related. See also e: labels. platform-linux Building on or for Linux specifically a: desktop Running on desktop team-linux Owned by the Linux platform team labels Jun 17, 2026
Add bounds validation to get_substring and get_string_at_offset to
prevent out-of-bounds memory access when ATK clients pass offsets
beyond the text length.

- get_substring: clamp start and end to [0, length] and ensure
  start <= end before calling g_utf8_substring.
- get_string_at_offset: clamp start and end to [0, n_attrs-1] before
  accessing the PangoLogAttr array.

Add tests for offset-beyond-end, empty text, and offset-at-end
boundary conditions.
@robert-ancell robert-ancell force-pushed the fix-accessible-text-field-bounds-checking branch from f3b0d5e to 9575ddf Compare June 17, 2026 23:49
@github-actions github-actions Bot removed the CICD Run CI/CD label Jun 17, 2026

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request introduces bounds checking to FlAccessibleTextField in the Linux platform shell. Specifically, it clamps the start and end offsets in get_substring and get_string_at_offset to prevent out-of-bounds access. Additionally, comprehensive unit tests are added to verify correct behavior under various edge cases, such as empty text and offsets beyond the text length. I have no feedback to provide.

@loic-sharma loic-sharma left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

@robert-ancell robert-ancell enabled auto-merge June 18, 2026 01:28
@robert-ancell robert-ancell added the CICD Run CI/CD label Jun 18, 2026
@robert-ancell robert-ancell added this pull request to the merge queue Jun 18, 2026
Merged via the queue into flutter:master with commit 1e36b1c Jun 18, 2026
200 of 201 checks passed
@robert-ancell robert-ancell deleted the fix-accessible-text-field-bounds-checking branch June 18, 2026 03:46
auto-submit Bot pushed a commit to flutter/packages that referenced this pull request Jun 18, 2026
flutter/flutter@b10d0f1...15963bc

2026-06-18 engine-flutter-autoroll@skia.org Roll Skia from 6e84902d56c3 to 1ae2466c9ea5 (4 revisions) (flutter/flutter#188172)
2026-06-18 engine-flutter-autoroll@skia.org Roll Packages from 6ce00a8 to 4fd05e6 (3 revisions) (flutter/flutter#188171)
2026-06-18 robert.ancell@canonical.com [Linux] Fix vertical offset in composite_layer (flutter/flutter#188145)
2026-06-18 robert.ancell@canonical.com [Linux] Fix incorrect GL datatypes for uniform locations (flutter/flutter#188143)
2026-06-18 engine-flutter-autoroll@skia.org Roll Dart SDK from e05c69222ea4 to 5883736e7670 (2 revisions) (flutter/flutter#188168)
2026-06-18 engine-flutter-autoroll@skia.org Roll Skia from 046277850e8d to 6e84902d56c3 (5 revisions) (flutter/flutter#188165)
2026-06-18 engine-flutter-autoroll@skia.org Roll Fuchsia Linux SDK from or21OEdGtairm6nl9... to 1E2qOlNnC2Ucn-1oV... (flutter/flutter#188162)
2026-06-18 engine-flutter-autoroll@skia.org Roll Skia from 8dd207d443d3 to 046277850e8d (1 revision) (flutter/flutter#188153)
2026-06-18 31859944+LongCatIsLooong@users.noreply.github.com Add entitlements.txt entries for new dart sdk binaries (flutter/flutter#188133)
2026-06-18 engine-flutter-autoroll@skia.org Roll Dart SDK from b670723c5f07 to e05c69222ea4 (1 revision) (flutter/flutter#188146)
2026-06-18 robert.ancell@canonical.com Fix bounds checking in FlAccessibleTextField (flutter/flutter#188137)
2026-06-18 engine-flutter-autoroll@skia.org Roll Skia from f5a2921fe23e to 8dd207d443d3 (2 revisions) (flutter/flutter#188141)
2026-06-18 30870216+gaaclarke@users.noreply.github.com Adds tests for disabling macos impeller (flutter/flutter#188132)
2026-06-17 jlemanski1@gmail.com Improve Flutter Web accessibility: update flt meta viewport tag to align with WCAG 2 guidelines (flutter/flutter#182047)
2026-06-17 engine-flutter-autoroll@skia.org Roll Dart SDK from e39bde5b1bfc to b670723c5f07 (2 revisions) (flutter/flutter#188130)
2026-06-17 engine-flutter-autoroll@skia.org Roll Skia from 066bfbac7282 to f5a2921fe23e (1 revision) (flutter/flutter#188128)
2026-06-17 matt.boetger@gmail.com Support --trace-systrace in release builds on Android (flutter/flutter#186359)
2026-06-17 matt.boetger@gmail.com Isolate compiled dill caches by TargetModel (flutter/flutter#187253)
2026-06-17 98614782+auto-submit[bot]@users.noreply.github.com Reverts "refactor(web): Unify Image on Skwasm and CanvasKit (#187873)" (flutter/flutter#188124)
2026-06-17 matt.kosarek@canonical.com Use a mock EGL manager in windows unittests to avoid flaky rendering calls (flutter/flutter#188078)
2026-06-17 matt.boetger@gmail.com [Android] Remove support for unused manifest flags (flutter/flutter#186021)
2026-06-17 30870216+gaaclarke@users.noreply.github.com Adds windows project switch for enabling impeller (flutter/flutter#188044)
2026-06-17 15619084+vashworth@users.noreply.github.com Skip prefetch SwiftPM dependencies if the project hasn't been migrated to SwiftPM yet (flutter/flutter#187206)
2026-06-17 nshahan@google.com [flutter_tools] Bump dwds to 27.1.2 (flutter/flutter#187951)
2026-06-17 30870216+gaaclarke@users.noreply.github.com Adds external texture devicelab test for windows impeller (flutter/flutter#187886)
2026-06-17 engine-flutter-autoroll@skia.org Roll Skia from 5d19002eb73e to 066bfbac7282 (2 revisions) (flutter/flutter#188118)
2026-06-17 34871572+gmackall@users.noreply.github.com Add note about magnifier issue when using transparent HCPP pv (flutter/flutter#187753)
2026-06-17 30870216+gaaclarke@users.noreply.github.com [linux]: fixes crash when resizing windows (flutter/flutter#187626)
2026-06-17 56400880+adilburaksen@users.noreply.github.com [flutter_tools] Enforce that package-declared asset paths stay within the package (flutter/flutter#187661)
2026-06-17 jason-simmons@users.noreply.github.com Remove canvaskit_cipd_instance from DEPS (flutter/flutter#188073)

If this roll has caused a breakage, revert this CL and stop the roller
using the controls here:
https://autoroll.skia.org/r/flutter-packages
Please CC bmparr@google.com,stuartmorgan@google.com on the revert to ensure that a human
is aware of the problem.

To file a bug in Packages: https://github.com/flutter/flutter/issues/new/choose

To report a problem with the AutoRoller itself, please file a bug:
https://issues.skia.org/issues/new?component=1389291&template=1850622

Documentation for the AutoRoller is here:
https://skia.googlesource.com/buildbot/+doc/main/autoroll/README.md
LouiseHsu pushed a commit to LouiseHsu/flutter that referenced this pull request Jun 18, 2026
Add bounds validation to get_substring and get_string_at_offset to
prevent out-of-bounds memory access when ATK clients pass offsets beyond
the text length.

- get_substring: clamp start and end to [0, length] and ensure start <=
end before calling g_utf8_substring.
- get_string_at_offset: clamp start and end to [0, n_attrs-1] before
accessing the PangoLogAttr array.

Add tests for offset-beyond-end, empty text, and offset-at-end boundary
conditions.
@loic-sharma loic-sharma added the cp: stable cherry pick this pull request to stable release candidate branch label Jun 18, 2026
loic-sharma pushed a commit to flutteractionsbot/flutter that referenced this pull request Jun 23, 2026
Add bounds validation to get_substring and get_string_at_offset to
prevent out-of-bounds memory access when ATK clients pass offsets beyond
the text length.

- get_substring: clamp start and end to [0, length] and ensure start <=
end before calling g_utf8_substring.
- get_string_at_offset: clamp start and end to [0, n_attrs-1] before
accessing the PangoLogAttr array.

Add tests for offset-beyond-end, empty text, and offset-at-end boundary
conditions.
via-guy pushed a commit to via-guy/flutter that referenced this pull request Jun 26, 2026
Add bounds validation to get_substring and get_string_at_offset to
prevent out-of-bounds memory access when ATK clients pass offsets beyond
the text length.

- get_substring: clamp start and end to [0, length] and ensure start <=
end before calling g_utf8_substring.
- get_string_at_offset: clamp start and end to [0, n_attrs-1] before
accessing the PangoLogAttr array.

Add tests for offset-beyond-end, empty text, and offset-at-end boundary
conditions.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

a: desktop Running on desktop a: text input Entering text in a text field or keyboard related problems CICD Run CI/CD cp: stable cherry pick this pull request to stable release candidate branch engine flutter/engine related. See also e: labels. platform-linux Building on or for Linux specifically team-linux Owned by the Linux platform team

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants