hoffstadt / hoffstadt/DearPyGui

`move_item` with the `before` argument can crash DPG if abused

Open
#2,644 0 comments 0 reactions 0 assignees View on GitHub
state: pending type: bug
Dominant language
C++
Stars
15.6k
Forks
783
PR merge metrics
No merged PRs in 30d

Description

## Version of Dear PyGui

Version: 2.3
Operating System: Windows 10

## My Issue/Question

While `move_item` now checks for parent/child compatibility, it does not check whether the item is being moved to an appropriate slot. As a result, `before` can be (ab)used to move an item to a slot where it does not belong, for example, move a drawing primitive from slot 2 to plot children' slot 1 (see the example below).

Notice that `move_item(parent=...)` does properly deduce the slot (can be tested with the "Move (append to plot)" button in the example).

## To Reproduce

Steps to reproduce the behavior:
1. Run the example
2. Click "Move (before axis)"
3. You'll get a segfault as the circle will be moved to immediate plot children slot 1 and treated as a mvPlotAxis.

## Expected behavior

`move_item` must raise an exception the same way it does when it bumps into incompatible parent.

## Screenshots/Video

None.

## Standalone, minimal, complete and verifiable example

```python
from math import sin
import dearpygui.dearpygui as dpg

dpg.create_context()
dpg.create_viewport(title=f"Test - {dpg.get_dearpygui_version()}", width=900, height=900)

with dpg.window():
dpg.set_primary_window(dpg.last_item(), True)

x_data = [x for x in range(0, 200)]
y_data = [10*sin(x/10)+100 for x in x_data]

with dpg.plot(width=-1, height=300) as plot:
dpg.add_plot_axis(dpg.mvXAxis)
with dpg.plot_axis(dpg.mvYAxis) as axis:
series = dpg.add_line_series(x_data, y_data)

victim = dpg.draw_circle((100, 100), 50)

dpg.add_button(label="Move (before axis)", callback=lambda: dpg.move_item(victim, before=axis))
dpg.add_button(label="Move (append to plot)", callback=lambda: dpg.move_item(victim, parent=plot))

dpg.setup_dearpygui()
dpg.show_viewport()
dpg.show_item_registry()
dpg.start_dearpygui()
dpg.destroy_context()
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.