Skip to content

macOS: Fix crash on out-of-bounds text input ranges - #191780

Merged
cbracken merged 1 commit into
flutter:masterfrom
cbracken:fix-out-of-bounds-text
Aug 27, 2026
Merged

cbracken merged 1 commit into
flutter:masterfrom
cbracken:fix-out-of-bounds-text

Conversation

@cbracken

@cbracken cbracken commented Aug 26, 2026 •

Copy link
Copy Markdown
Member

TextInputModel assumes its selection and composing range fall within its text, but nothing in the text input plugin enforced that. When they don't, we index past the end of text_ which triggers an abort due to out of range access.

Previously, setMarkedText:selectedRange:replacementRange: passed selectedRange unvalidated. IMEs report NSNotFound to indicate no selection within the mark text. That maps to NSIntegerMax rather than an offset, and we incorrectly stored that as the selection. Clearing the marked text collapses the composing range, so the next update replaces the selection instead and calls replace with a position NSIntegerMax. Clear and re-mark is what an input method emits when the input source is switched mid-composition.

SetText was also unsafe: it assigned text_ before validating the ranges, so a rejected update left us with the new text but the old (now out-of-bounds) ranges still pointing into it.

This fixes that by clamping both ranges before any operation that indexes the text, applying either all of SetText's fields or none, and clamping selectedRange and replacementRange in the plugin. setMarkedText: also null-checks the UTF-16 buffer, which cStringUsingEncoding: can return as nullptr.

Fixes: #190704

Pre-launch Checklist

If you need help, consider asking for advice on the #hackers-new channel on Discord.

If this change needs to override an active code freeze, provide a comment explaining why. The code freeze workflow can be overridden by code reviewers. See pinned issues for any active code freezes with guidance.

Note: The Flutter team is currently trialing the use of Gemini Code Assist for GitHub. Comments from the gemini-code-assist bot should not be taken as authoritative feedback from the Flutter team. If you find its comments useful you can update your code accordingly, but if you are unsure or disagree with the feedback, please feel free to wait for a Flutter team member's review for guidance on which automated comments should be addressed.

@cbracken
cbracken requested a review from a team as a code owner August 26, 2026 06:45
@flutter-dashboard flutter-dashboard Bot added the CICD Run CI/CD label Aug 26, 2026
@github-actions github-actions Bot added a: text input Entering text in a text field or keyboard related problems engine flutter/engine related. See also e: labels. platform-macos Building on or for macOS specifically a: desktop Running on desktop team-macos Owned by the macOS platform team labels Aug 26, 2026

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request introduces bounds clamping for text selection and composing ranges in TextInputModel and FlutterTextInputPlugin to prevent out-of-bounds indexing and crashes, accompanied by new unit tests. The review feedback suggests adding defensive type validation for the state dictionary in setEditingState: and refactoring the UTF-16 string conversion in setMarkedText: to avoid potential crashes and encoding issues.

`TextInputModel` assumes its selection and composing range fall within
its text, but nothing in the text input plugin enforced that. When they
don't, we index past the end of `text_` which triggers an abort due to
out of range access.

```
out_of_range was thrown in -fno-exceptions mode with message "basic_string"
```

Previously, `setMarkedText:selectedRange:replacementRange:` passed
`selectedRange` unvalidated. IMEs report `NSNotFound` to indicate no
selection within the mark text. That maps to `NSIntegerMax` rather than
an offset, and we incorrectly stored that as the selection. Clearing the
marked text collapses the composing range, so the next update replaces
the selection instead and calls `replace` with a position
`NSIntegerMax`. Clear and re-mark is what an input method emits when the
input source is switched mid-composition.

`SetText` was also unsafe: it assigned `text_` before validating the
ranges, so a rejected update left us with the new text but the old (now
out-of-bounds) ranges still pointing into it.

This fixes that by clamping both ranges before any operation that
indexes the text, applying either all of `SetText`'s fields or none, and
clamping `selectedRange` and `replacementRange` in the plugin.
`setMarkedText:` also null-checks the UTF-16 buffer, which
`cStringUsingEncoding:` can return as nullptr.

Fixes: flutter#190704
@cbracken
cbracken force-pushed the fix-out-of-bounds-text branch from b6213fc to 4e7ae1e Compare August 26, 2026 07:14
@cbracken
cbracken requested a review from justinmc August 26, 2026 10:07

@LongCatIsLooong LongCatIsLooong left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The code changes LGTM. But I'm not sure why we need to clamp the ranges in the first place (l remember the iOS text input plugin does that too but I suspect that is not needed). If the IME sends us an OOB range I think it's either our implementation is doing something wrong (like not informing the IME of text changes when the framework makes changes to the model), or it is an IME bug?

@cbracken
cbracken added this pull request to the merge queue Aug 27, 2026
@cbracken

Copy link
Copy Markdown
Member Author

In this case, it's almost certainly an async issue/race. We should resolve the underlying issue too by implementing some form of serialisation.

Merged via the queue into flutter:master with commit e100f30 Aug 27, 2026
18 of 20 checks passed
@cbracken
cbracken deleted the fix-out-of-bounds-text branch August 27, 2026 06:52
auto-submit Bot pushed a commit to flutter/packages that referenced this pull request Aug 28, 2026
Roll Flutter from 15d8908addf6 to e8dca90ec9e0 (58 revisions)

flutter/flutter@15d8908...e8dca90

2026-08-27 [email protected] Terminate existing process before launching with devicectl (flutter/flutter#191885)
2026-08-27 [email protected] Roll Fuchsia Linux SDK from qjOQi-zAgu_tADorh... to dDxH8G5cDBP602eyG... (flutter/flutter#191889)
2026-08-27 [email protected] [flutter_tools] Verify native assets tree-shaking during linking (flutter/flutter#191637)
2026-08-27 [email protected] Denylists b-series powervr from vulkan (flutter/flutter#191808)
2026-08-27 [email protected] Handle linear and radial gradients in UberSDF (flutter/flutter#190874)
2026-08-27 [email protected] Roll Packages from 740f093 to bd3cbc1 (7 revisions) (flutter/flutter#191886)
2026-08-27 [email protected] Disable more Windows tests that have been causing CI flakes (flutter/flutter#191822)
2026-08-27 [email protected] Roll Skia from d32721369bd8 to 82e972ea84b1 (2 revisions) (flutter/flutter#191880)
2026-08-27 [email protected] Roll Skia from 3640b8edd16c to d32721369bd8 (10 revisions) (flutter/flutter#191858)
2026-08-27 [email protected] Revert: [AGP 9] Update remaining tests to AGP 9 (flutter/flutter#191863)
2026-08-27 [email protected] Roll Fuchsia Test Scripts from 0iCv10IlKfiilEBOU... to 6SXRz6wsA2Zm_rAqP... (flutter/flutter#191852)
2026-08-27 [email protected] Roll pub packages (flutter/flutter#191851)
2026-08-27 [email protected] Refactor FormField build wrappers (flutter/flutter#185795)
2026-08-27 [email protected] Make ScrollPhysics reactive by introducing shouldUpdate (flutter/flutter#189664)
2026-08-27 [email protected] macOS: Fix crash on out-of-bounds text input ranges (flutter/flutter#191780)
2026-08-27 [email protected] Add HCPP feature flag, and turn it on by default in beta/master (flutter/flutter#190623)
2026-08-27 [email protected] [tool] Migrate CleanCommand to modular dependency injection (flutter/flutter#190742)
2026-08-26 [email protected] Update triage docs for ecosystem and codelab changes (flutter/flutter#191809)
2026-08-26 [email protected] [AGP 9] Update remaining tests to AGP 9 (flutter/flutter#191824)
2026-08-26 [email protected] [UIScene] Migrate dev/benchmarks/complex_layout to UIScene lifecycle (flutter/flutter#191619)
2026-08-26 [email protected] Add SliverAppBar showOnScreen semantics test coverage (flutter/flutter#190410)
2026-08-26 [email protected] Add prompt_suggestion icon to list of RTL mirroring icons. (flutter/flutter#191741)
2026-08-26 [email protected] Remove bringup for batch 3 (flutter/flutter#191750)
2026-08-26 [email protected] Roll Skia from b5465d7b0b77 to 3640b8edd16c (6 revisions) (flutter/flutter#191835)
2026-08-26 [email protected] Uiscene migrate custom channels views (flutter/flutter#191817)
2026-08-26 [email protected] Support --[no-]adb-log-filtering CLI option (flutter/flutter#187252)
2026-08-26 [email protected] Roll Dart SDK from cb8a4e1a0fbb to cb4c39d067f3 (2 revisions) (flutter/flutter#191825)
2026-08-26 [email protected] Fix `Navigator.pushNamed<T>()` type checking (flutter/flutter#188148)
2026-08-26 [email protected] Handle the case where a window doesn't have a title set (flutter/flutter#191767)
2026-08-26 [email protected] [Android] Remove old `InputType` constructor from embedding (flutter/flutter#191244)
2026-08-26 [email protected] Roll Skia from 244a6a0f8f92 to b5465d7b0b77 (19 revisions) (flutter/flutter#191810)
2026-08-26 [email protected] Tolerate floating-point rounding in paintImage centerSlice assertion (flutter/flutter#185789)
2026-08-26 [email protected] Fixes translated bounded blurs (flutter/flutter#191615)
2026-08-26 [email protected] Roll Fuchsia Linux SDK from MstTWE1RDOT-RnrtH... to qjOQi-zAgu_tADorh... (flutter/flutter#191769)
2026-08-26 [email protected] Lerp HSVColor and HSLColor hue along the shortest arc (flutter/flutter#191186)
2026-08-26 [email protected] Fix enum instances comparison to use `equality ==` since dart has the correct behavior now (flutter/flutter#191537)
2026-08-26 [email protected] Switches windows to opengles 3 (flutter/flutter#191516)
2026-08-26 [email protected] Roll Dart SDK from 7739e8602bc1 to cb8a4e1a0fbb (1 revision) (flutter/flutter#191784)
2026-08-26 [email protected] iOS,macOS: Check viewType before creating a platform view (flutter/flutter#191777)
2026-08-26 [email protected] Revert: [tool_tests] Remove bringup from Windows tool_tests_commands_2_2 (flutter/flutter#191793)
2026-08-26 [email protected] refactor(flutter_tools): clean up dead unreferenced declarations (flutter/flutter#191163)
2026-08-26 [email protected] Roll Fuchsia GN SDK from a87CbQSWEjkPUK1ZY... to ZsxUUK2SfA-TrNvb8... (flutter/flutter#191763)
2026-08-26 [email protected] [tool_tests] Remove bringup from Windows tool_tests_commands_2_2 (flutter/flutter#191732)
2026-08-25 [email protected] Remove legacy gen_defaults analyze checks (flutter/flutter#191629)
2026-08-25 [email protected] Refactors `try` to avoid `unawaited_return_in_try_block` case (flutter/flutter#191129)
2026-08-25 [email protected] Roll Dart SDK from 8996935d3d0a to 7739e8602bc1 (1 revision) (flutter/flutter#191754)
...
victorsanni pushed a commit to victorsanni/packages that referenced this pull request Sep 9, 2026
…r#12660)

Roll Flutter from 15d8908addf6 to e8dca90ec9e0 (58 revisions)

flutter/flutter@15d8908...e8dca90

2026-08-27 [email protected] Terminate existing process before launching with devicectl (flutter/flutter#191885)
2026-08-27 [email protected] Roll Fuchsia Linux SDK from qjOQi-zAgu_tADorh... to dDxH8G5cDBP602eyG... (flutter/flutter#191889)
2026-08-27 [email protected] [flutter_tools] Verify native assets tree-shaking during linking (flutter/flutter#191637)
2026-08-27 [email protected] Denylists b-series powervr from vulkan (flutter/flutter#191808)
2026-08-27 [email protected] Handle linear and radial gradients in UberSDF (flutter/flutter#190874)
2026-08-27 [email protected] Roll Packages from 740f093 to bd3cbc1 (7 revisions) (flutter/flutter#191886)
2026-08-27 [email protected] Disable more Windows tests that have been causing CI flakes (flutter/flutter#191822)
2026-08-27 [email protected] Roll Skia from d32721369bd8 to 82e972ea84b1 (2 revisions) (flutter/flutter#191880)
2026-08-27 [email protected] Roll Skia from 3640b8edd16c to d32721369bd8 (10 revisions) (flutter/flutter#191858)
2026-08-27 [email protected] Revert: [AGP 9] Update remaining tests to AGP 9 (flutter/flutter#191863)
2026-08-27 [email protected] Roll Fuchsia Test Scripts from 0iCv10IlKfiilEBOU... to 6SXRz6wsA2Zm_rAqP... (flutter/flutter#191852)
2026-08-27 [email protected] Roll pub packages (flutter/flutter#191851)
2026-08-27 [email protected] Refactor FormField build wrappers (flutter/flutter#185795)
2026-08-27 [email protected] Make ScrollPhysics reactive by introducing shouldUpdate (flutter/flutter#189664)
2026-08-27 [email protected] macOS: Fix crash on out-of-bounds text input ranges (flutter/flutter#191780)
2026-08-27 [email protected] Add HCPP feature flag, and turn it on by default in beta/master (flutter/flutter#190623)
2026-08-27 [email protected] [tool] Migrate CleanCommand to modular dependency injection (flutter/flutter#190742)
2026-08-26 [email protected] Update triage docs for ecosystem and codelab changes (flutter/flutter#191809)
2026-08-26 [email protected] [AGP 9] Update remaining tests to AGP 9 (flutter/flutter#191824)
2026-08-26 [email protected] [UIScene] Migrate dev/benchmarks/complex_layout to UIScene lifecycle (flutter/flutter#191619)
2026-08-26 [email protected] Add SliverAppBar showOnScreen semantics test coverage (flutter/flutter#190410)
2026-08-26 [email protected] Add prompt_suggestion icon to list of RTL mirroring icons. (flutter/flutter#191741)
2026-08-26 [email protected] Remove bringup for batch 3 (flutter/flutter#191750)
2026-08-26 [email protected] Roll Skia from b5465d7b0b77 to 3640b8edd16c (6 revisions) (flutter/flutter#191835)
2026-08-26 [email protected] Uiscene migrate custom channels views (flutter/flutter#191817)
2026-08-26 [email protected] Support --[no-]adb-log-filtering CLI option (flutter/flutter#187252)
2026-08-26 [email protected] Roll Dart SDK from cb8a4e1a0fbb to cb4c39d067f3 (2 revisions) (flutter/flutter#191825)
2026-08-26 [email protected] Fix `Navigator.pushNamed<T>()` type checking (flutter/flutter#188148)
2026-08-26 [email protected] Handle the case where a window doesn't have a title set (flutter/flutter#191767)
2026-08-26 [email protected] [Android] Remove old `InputType` constructor from embedding (flutter/flutter#191244)
2026-08-26 [email protected] Roll Skia from 244a6a0f8f92 to b5465d7b0b77 (19 revisions) (flutter/flutter#191810)
2026-08-26 [email protected] Tolerate floating-point rounding in paintImage centerSlice assertion (flutter/flutter#185789)
2026-08-26 [email protected] Fixes translated bounded blurs (flutter/flutter#191615)
2026-08-26 [email protected] Roll Fuchsia Linux SDK from MstTWE1RDOT-RnrtH... to qjOQi-zAgu_tADorh... (flutter/flutter#191769)
2026-08-26 [email protected] Lerp HSVColor and HSLColor hue along the shortest arc (flutter/flutter#191186)
2026-08-26 [email protected] Fix enum instances comparison to use `equality ==` since dart has the correct behavior now (flutter/flutter#191537)
2026-08-26 [email protected] Switches windows to opengles 3 (flutter/flutter#191516)
2026-08-26 [email protected] Roll Dart SDK from 7739e8602bc1 to cb8a4e1a0fbb (1 revision) (flutter/flutter#191784)
2026-08-26 [email protected] iOS,macOS: Check viewType before creating a platform view (flutter/flutter#191777)
2026-08-26 [email protected] Revert: [tool_tests] Remove bringup from Windows tool_tests_commands_2_2 (flutter/flutter#191793)
2026-08-26 [email protected] refactor(flutter_tools): clean up dead unreferenced declarations (flutter/flutter#191163)
2026-08-26 [email protected] Roll Fuchsia GN SDK from a87CbQSWEjkPUK1ZY... to ZsxUUK2SfA-TrNvb8... (flutter/flutter#191763)
2026-08-26 [email protected] [tool_tests] Remove bringup from Windows tool_tests_commands_2_2 (flutter/flutter#191732)
2026-08-25 [email protected] Remove legacy gen_defaults analyze checks (flutter/flutter#191629)
2026-08-25 [email protected] Refactors `try` to avoid `unawaited_return_in_try_block` case (flutter/flutter#191129)
2026-08-25 [email protected] Roll Dart SDK from 8996935d3d0a to 7739e8602bc1 (1 revision) (flutter/flutter#191754)
...
victorsanni pushed a commit to victorsanni/packages that referenced this pull request Sep 9, 2026
…r#12660)

Roll Flutter from 15d8908addf6 to e8dca90ec9e0 (58 revisions)

flutter/flutter@15d8908...e8dca90

2026-08-27 [email protected] Terminate existing process before launching with devicectl (flutter/flutter#191885)
2026-08-27 [email protected] Roll Fuchsia Linux SDK from qjOQi-zAgu_tADorh... to dDxH8G5cDBP602eyG... (flutter/flutter#191889)
2026-08-27 [email protected] [flutter_tools] Verify native assets tree-shaking during linking (flutter/flutter#191637)
2026-08-27 [email protected] Denylists b-series powervr from vulkan (flutter/flutter#191808)
2026-08-27 [email protected] Handle linear and radial gradients in UberSDF (flutter/flutter#190874)
2026-08-27 [email protected] Roll Packages from 740f093 to bd3cbc1 (7 revisions) (flutter/flutter#191886)
2026-08-27 [email protected] Disable more Windows tests that have been causing CI flakes (flutter/flutter#191822)
2026-08-27 [email protected] Roll Skia from d32721369bd8 to 82e972ea84b1 (2 revisions) (flutter/flutter#191880)
2026-08-27 [email protected] Roll Skia from 3640b8edd16c to d32721369bd8 (10 revisions) (flutter/flutter#191858)
2026-08-27 [email protected] Revert: [AGP 9] Update remaining tests to AGP 9 (flutter/flutter#191863)
2026-08-27 [email protected] Roll Fuchsia Test Scripts from 0iCv10IlKfiilEBOU... to 6SXRz6wsA2Zm_rAqP... (flutter/flutter#191852)
2026-08-27 [email protected] Roll pub packages (flutter/flutter#191851)
2026-08-27 [email protected] Refactor FormField build wrappers (flutter/flutter#185795)
2026-08-27 [email protected] Make ScrollPhysics reactive by introducing shouldUpdate (flutter/flutter#189664)
2026-08-27 [email protected] macOS: Fix crash on out-of-bounds text input ranges (flutter/flutter#191780)
2026-08-27 [email protected] Add HCPP feature flag, and turn it on by default in beta/master (flutter/flutter#190623)
2026-08-27 [email protected] [tool] Migrate CleanCommand to modular dependency injection (flutter/flutter#190742)
2026-08-26 [email protected] Update triage docs for ecosystem and codelab changes (flutter/flutter#191809)
2026-08-26 [email protected] [AGP 9] Update remaining tests to AGP 9 (flutter/flutter#191824)
2026-08-26 [email protected] [UIScene] Migrate dev/benchmarks/complex_layout to UIScene lifecycle (flutter/flutter#191619)
2026-08-26 [email protected] Add SliverAppBar showOnScreen semantics test coverage (flutter/flutter#190410)
2026-08-26 [email protected] Add prompt_suggestion icon to list of RTL mirroring icons. (flutter/flutter#191741)
2026-08-26 [email protected] Remove bringup for batch 3 (flutter/flutter#191750)
2026-08-26 [email protected] Roll Skia from b5465d7b0b77 to 3640b8edd16c (6 revisions) (flutter/flutter#191835)
2026-08-26 [email protected] Uiscene migrate custom channels views (flutter/flutter#191817)
2026-08-26 [email protected] Support --[no-]adb-log-filtering CLI option (flutter/flutter#187252)
2026-08-26 [email protected] Roll Dart SDK from cb8a4e1a0fbb to cb4c39d067f3 (2 revisions) (flutter/flutter#191825)
2026-08-26 [email protected] Fix `Navigator.pushNamed<T>()` type checking (flutter/flutter#188148)
2026-08-26 [email protected] Handle the case where a window doesn't have a title set (flutter/flutter#191767)
2026-08-26 [email protected] [Android] Remove old `InputType` constructor from embedding (flutter/flutter#191244)
2026-08-26 [email protected] Roll Skia from 244a6a0f8f92 to b5465d7b0b77 (19 revisions) (flutter/flutter#191810)
2026-08-26 [email protected] Tolerate floating-point rounding in paintImage centerSlice assertion (flutter/flutter#185789)
2026-08-26 [email protected] Fixes translated bounded blurs (flutter/flutter#191615)
2026-08-26 [email protected] Roll Fuchsia Linux SDK from MstTWE1RDOT-RnrtH... to qjOQi-zAgu_tADorh... (flutter/flutter#191769)
2026-08-26 [email protected] Lerp HSVColor and HSLColor hue along the shortest arc (flutter/flutter#191186)
2026-08-26 [email protected] Fix enum instances comparison to use `equality ==` since dart has the correct behavior now (flutter/flutter#191537)
2026-08-26 [email protected] Switches windows to opengles 3 (flutter/flutter#191516)
2026-08-26 [email protected] Roll Dart SDK from 7739e8602bc1 to cb8a4e1a0fbb (1 revision) (flutter/flutter#191784)
2026-08-26 [email protected] iOS,macOS: Check viewType before creating a platform view (flutter/flutter#191777)
2026-08-26 [email protected] Revert: [tool_tests] Remove bringup from Windows tool_tests_commands_2_2 (flutter/flutter#191793)
2026-08-26 [email protected] refactor(flutter_tools): clean up dead unreferenced declarations (flutter/flutter#191163)
2026-08-26 [email protected] Roll Fuchsia GN SDK from a87CbQSWEjkPUK1ZY... to ZsxUUK2SfA-TrNvb8... (flutter/flutter#191763)
2026-08-26 [email protected] [tool_tests] Remove bringup from Windows tool_tests_commands_2_2 (flutter/flutter#191732)
2026-08-25 [email protected] Remove legacy gen_defaults analyze checks (flutter/flutter#191629)
2026-08-25 [email protected] Refactors `try` to avoid `unawaited_return_in_try_block` case (flutter/flutter#191129)
2026-08-25 [email protected] Roll Dart SDK from 8996935d3d0a to 7739e8602bc1 (1 revision) (flutter/flutter#191754)
...
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

a: desktop Running on desktop a: text input Entering text in a text field or keyboard related problems CICD Run CI/CD engine flutter/engine related. See also e: labels. platform-macos Building on or for macOS specifically team-macos Owned by the macOS platform team

Projects

None yet

2 participants