[Scummvm-tracker] [ScummVM :: Bugs] #17277: GUI: Some mactext canvas surfaces are used before fully initialized

[ScummVM :: Bugs]

#17277: GUI: Some mactext canvas surfaces are used before fully initialized
--------------------------+---------------------
Reporter:  tunnelsociety  |       Owner:  (none)
    Type:  defect         |      Status:  new
Priority:  low            |   Component:  GUI
 Version:                 |  Resolution:
Keywords:                 |        Game:
--------------------------+---------------------
Description changed by tunnelsociety:

Old description:

> Hi!
> ubsan reports something when during gameplay, in GMM (Ctrl+F5), I click
> the Help button.
>
> It looks like in `MacTextCanvas::render(int, int)` the `_glyphMask` and
> `_charBoxMask` have null `pixels`. (`Surface::getBasePtr()` returns `0x1`
> instead of a useful address.) I did only a little reading and didn't
> figure out where those pixels should be initialized.
>
> {{{
> graphics/surface.h:153:50: runtime error: applying non-zero offset 1 to
> null pointer
>
> (gdb) bt
> [...]
> #4  0x0000555558d9e914 in Graphics::MacTextCanvas::render
> (this=0x51d000111528, from=0, to=31, target=0x50b00008f300,
> fillColor=255,
>     bboxesOnly=false) at graphics/macgui/mactext-canvas.cpp:683
> #5  0x0000555558da3ec1 in Graphics::MacTextCanvas::render
> (this=0x51d000111528, from=0, to=31) at graphics/macgui/mactext-
> canvas.cpp:792
> #6  0x0000555558ce721a in Graphics::MacText::render (this=0x51d000111280)
> at graphics/macgui/mactext.cpp:664
> #7  0x0000555558d282b7 in Graphics::MacText::setText
> (this=0x51d000111280, str=...) at graphics/macgui/mactext.cpp:2037
> #8  0x0000555558dbf38e in Graphics::MacText::setMarkdownText
> (this=0x51d000111280, str=...) at graphics/macgui/mactext-md.cpp:379
> #9  0x000055555877e51d in GUI::RichTextWidget::createWidget
> (this=0x5160001f1a80) at gui/widgets/richtext.cpp:348
> #10 0x00005555587826d5 in GUI::RichTextWidget::ensureWidget
> (this=0x5160001f1a80) at gui/widgets/richtext.cpp:398
> #11 0x00005555587828dd in GUI::RichTextWidget::drawWidget
> (this=0x5160001f1a80) at gui/widgets/richtext.cpp:402
> #12 0x00005555586787ca in GUI::Widget::draw (this=0x5160001f1a80) at
> gui/widget.cpp:119
> #13 0x0000555558784bae in GUI::RichTextWidget::draw (this=0x5160001f1a80)
> at gui/widgets/richtext.cpp:433
> #14 0x0000555558678c0d in GUI::Widget::draw (this=0x513000061b00) at
> gui/widget.cpp:130
> #15 0x00005555587aad5e in GUI::TabWidget::draw (this=0x513000061b00) at
> gui/widgets/tab.cpp:421
> #16 0x00005555583cae18 in GUI::Dialog::drawWidgets (this=0x7ffff4d69670)
> at gui/dialog.cpp:204
> }}}
>
> version:
> {{{
> ScummVM 2026.3.1git10807-g666cee41f63-dirty (Oct  4 2026 13:53:00)
> Using SDL backend with SDL 3.2.10
> Features compiled in: Vorbis ALSA sndio RGB zLib FreeType2 PNG GIF SDL3
> OpenGL
> }}}

New description:

 Hi!
 ubsan reports something when during gameplay, in GMM (Ctrl+F5), I click
 the Help button.

 It looks like in `MacTextCanvas::render(int, int)` the `_glyphMask` and
 `_charBoxMask` have null `pixels`. (`Surface::getBasePtr()` returns `0x1`
 instead of a useful address.) I did only a little reading and didn't
 figure out where those pixels should be initialized.

 {{{
 graphics/surface.h:153:50: runtime error: applying non-zero offset 1 to
 null pointer

 (gdb) bt
 [...]
 #4  0x0000555557481ee7 in Graphics::Surface::getBasePtr
 (this=0x50b0000954a8, x=1, y=0) at ./graphics/surface.h:153
 #5  0x0000555558f8b785 in Graphics::Surface::fillRect
 (this=0x50b0000954a8, r=..., color=255) at graphics/surface.cpp:386
 #6  0x0000555557588ce1 in Graphics::ManagedSurface::fillRect
 (this=0x50b0000954a0, r=..., color=255) at
 ./graphics/managed_surface.h:955
 #7  0x0000555558da62cf in Graphics::MacTextCanvas::render
 (this=0x51d000111528, from=0, to=31, target=0x50b0000954a0, fillColor=255,
     bboxesOnly=true) at graphics/macgui/mactext-canvas.cpp:769
 #8  0x0000555558da704d in Graphics::MacTextCanvas::render
 (this=0x51d000111528, from=0, to=31) at graphics/macgui/mactext-
 canvas.cpp:792
 #9  0x0000555558cea44a in Graphics::MacText::render (this=0x51d000111280)
 at graphics/macgui/mactext.cpp:664
 #10 0x0000555558d2b4e7 in Graphics::MacText::setText (this=0x51d000111280,
 str=...) at graphics/macgui/mactext.cpp:2037
 #11 0x0000555558dc24be in Graphics::MacText::setMarkdownText
 (this=0x51d000111280, str=...) at graphics/macgui/mactext-md.cpp:379
 #12 0x000055555878174d in GUI::RichTextWidget::createWidget
 (this=0x5160001f1780) at gui/widgets/richtext.cpp:348
 #13 0x0000555558785905 in GUI::RichTextWidget::ensureWidget
 (this=0x5160001f1780) at gui/widgets/richtext.cpp:398
 #14 0x0000555558785b0d in GUI::RichTextWidget::drawWidget
 (this=0x5160001f1780) at gui/widgets/richtext.cpp:402
 #15 0x000055555867b9fa in GUI::Widget::draw (this=0x5160001f1780) at
 gui/widget.cpp:119
 [...]
 }}}

 version:
 {{{
 ScummVM 2026.3.1git10807-g666cee41f63-dirty (Oct  4 2026 13:53:00)
 Using SDL backend with SDL 3.2.10
 Features compiled in: Vorbis ALSA sndio RGB zLib FreeType2 PNG GIF SDL3
 OpenGL
 }}}

--
-- 
Ticket URL: <https://bugs.scummvm.org/ticket/17277#comment:1>
ScummVM :: Bugs <https://bugs.scummvm.org>
ScummVM