UB in GlyphArrangement::addFittedText/SimpleShapedText::getTextRange

[dave96]

I’ve been hitting some UB in our app deep inside the text rending stack but it’s also easy to trigger in the juce demo.

If you do the following:

• In Xcode
• Enable UBSan
• Add a runtime exception breakpoint for UBSan
• Run the JUCE DemoRunner in debug
  • Go to “Demos”
  • “Widgets”
  • “Sliders”

You’ll see the following:

It seems like:

• glyphIndex is less than glyphRange.getStart(); so indexInRun (which is an int) is negative
• When this is cast to a size_t it underflows to a very large number (well defined behaviour)
• This is then used to index in to the glyphRun which overflows the ptr
• Adding an assertion that index < size() in there would probably catch this as well

The args to GlyphArrangement::addFittedText look fine.
The weird thing is that this isn’t causing crashes without UBSan enabled. Maybe I’m just lucky and it’s manifesting as minor text corruption?

Cheers

[attila]

Thank you for the detailed report. There’s a fix out on develop

Fix SimpleShapedText::getTextRange() when the input text contains hard breaks

[dave96]

Thanks!