Skip to content

fix the panic in TextInput Secure#3308

Open
xMAC94x wants to merge 1 commit intoiced-rs:masterfrom
xMAC94x:xMAC94x/fix_3288
Open

fix the panic in TextInput Secure#3308
xMAC94x wants to merge 1 commit intoiced-rs:masterfrom
xMAC94x:xMAC94x/fix_3288

Conversation

@xMAC94x
Copy link
Copy Markdown

@xMAC94x xMAC94x commented Apr 16, 2026

use iced::widget::text_input::Value;

pub fn main() {
    let clear_value = Value::new("abcd");
    let secure_value = clear_value.secure().to_string();

    // Voxygen's custom paragraph hit-testing returns a character index.
    // For a click near the first masked bullet, this can be 1.
    let voxygen_hit_test_offset = 1;

    println!("masked value: {secure_value:?}");
    println!("masked bytes: {}", secure_value.len());
    println!("voxygen hit-test character offset: {voxygen_hit_test_offset}");

    // This is the vulnerable operation from iced_widget 0.14:
    //
    //   &value[..char_offset.min(value.len())]
    //
    // `voxygen_hit_test_offset` is a character offset, but `str` slicing expects
    // a byte offset. Since `•` is three bytes in UTF-8, offset 1 lands inside it.
    let _prefix = &secure_value[..voxygen_hit_test_offset.min(secure_value.len())];

    unreachable!("the slice above should panic before this point");
}

fixes #3288

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

TextInput::secure(true) panics on cursor hit-testing because masked value uses multibyte

1 participant