InputTextMultiline copy paste buffer overflow bug

[LPVOIDDev]

Version/Branch of Dear ImGui:

Version: Dear ImGui 1.83 WIP (18203)
Branch: master

Back-end/Renderer/Compiler/OS

Back-ends: imgui_impl_win32.cpp + imgui_impl_dx10.cpp
Compiler: Visual Studio 2015 (v140)
Operating System: Windows 10 (1809)

My Issue/Question:

The whole program hangs when copy-pasting a text in a InputTextMultiline with buffer size 1024

Steps to reproduce:

1. In the imgui_demo.cpp edit the line static char text[1024 * 16] = to static char text[1024 * 1] =
2. Start demo and go to Demo > Widgets > Text Input > Multi-line Text Input
3. Put mouse cursor inside InputTextMultiline
4. Ctrl+A
5. Ctrl+C
6. Ctrl+V (x5)
7. Ctrl+A
8. Ctrl+V
9. *Program hangs*

Some insight:
Unfortunately, I was not able to debug the issue directly from VS2015 because the debugger doesn't work on this version of VS.
But I've gone through manually debugging with CE
I found out that it never goes out of this loop because state->undo_char_point + numchars is always 1050 whereas STB_TEXTEDIT_UNDOCHARCOUNT is set to 999

ECX value never changes and is stuck with value 1050 (0x41a)

[PathogenDavid]

Thanks for the repro, @LPVOIDDev! I can reproduce this now.

It looks like that loop is expecting stb_textedit_discard_undo to clean up undo_char_point, which it will:

imgui/imstb_textedit.h

Line 1134 in d6a5cc7

state->undo_char_point -= n;

But it isn't doing that because undo_point is 0. I suspect that undo_char_point isn't expected to be non-zero when undo_point is 0, but I'm not particularly familiar with the stb_textedit stuff.

This external issue appears to be the root cause: nothings/stb#734

I agree with Unit2Ed here. Unless I'm missing something, removing the undo point seems unnecessary because it was never even created. I removed the decrement like they mentioned and the problem goes away for me. It seems to me like a failed insert has the potential to corrupt stb_textedit's undo stack.

I'd need more time to investigate for sure though, I didn't dig into things very much.

[v71]

If state->undo_char_point is an unsigned integer then the value is set to 255 , which eventulally will lead to a loop.

[ocornut]

Fixed by d9b6066 and submitting PR to nothings/stb
Thanks you!