Skip to content

move_item with the before argument can crash DPG if abused #2644

@v-ein

Description

@v-ein

Version of Dear PyGui

Version: 2.3
Operating System: Windows 10

My Issue/Question

While move_item now checks for parent/child compatibility, it does not check whether the item is being moved to an appropriate slot. As a result, before can be (ab)used to move an item to a slot where it does not belong, for example, move a drawing primitive from slot 2 to plot children' slot 1 (see the example below).

Notice that move_item(parent=...) does properly deduce the slot (can be tested with the "Move (append to plot)" button in the example).

To Reproduce

Steps to reproduce the behavior:

  1. Run the example
  2. Click "Move (before axis)"
  3. You'll get a segfault as the circle will be moved to immediate plot children slot 1 and treated as a mvPlotAxis.

Expected behavior

move_item must raise an exception the same way it does when it bumps into incompatible parent.

Screenshots/Video

None.

Standalone, minimal, complete and verifiable example

from math import sin
import dearpygui.dearpygui as dpg

dpg.create_context()
dpg.create_viewport(title=f"Test - {dpg.get_dearpygui_version()}", width=900, height=900)

with dpg.window():
    dpg.set_primary_window(dpg.last_item(), True)

    x_data = [x for x in range(0, 200)]
    y_data = [10*sin(x/10)+100 for x in x_data]

    with dpg.plot(width=-1, height=300) as plot:
        dpg.add_plot_axis(dpg.mvXAxis)
        with dpg.plot_axis(dpg.mvYAxis) as axis:
            series = dpg.add_line_series(x_data, y_data)

    victim = dpg.draw_circle((100, 100), 50)

    dpg.add_button(label="Move (before axis)", callback=lambda: dpg.move_item(victim, before=axis))
    dpg.add_button(label="Move (append to plot)", callback=lambda: dpg.move_item(victim, parent=plot))

dpg.setup_dearpygui()
dpg.show_viewport()
dpg.show_item_registry()
dpg.start_dearpygui()
dpg.destroy_context()

Metadata

Metadata

Assignees

No one assigned

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions