[Audit][High] Widget struct function pointers never initialized, causing segfault on use

[MichaelFisher1997]

🔍 Module Scanned\n (automated audit scan)\n\n## 📝 Summary\nThe struct exposes two function pointer fields ( and ) as public API, but these pointers are never initialized with default values. When the struct is instantiated without explicitly setting these fields, any call to or will cause a segmentation fault. This is a latent crash vector in a codebase that otherwise follows strict memory safety practices.\n\n## 📍 Location\n- File: \n- Function/Scope: struct definition\n\n## 🔴 Severity: High\n- High: latent segfault risk for any consumer of the Widget API\n\n## 💥 Impact\nIf any code path instantiates a struct without initializing and , calling or will immediately segfault. The struct is publicly exported and could be instantiated by module consumers. The virtual function pattern is implemented but the struct cannot be safely used without additional setup beyond the struct definition.\n\n## 🔎 Evidence\n\n\n\nThe function pointers and have no default initialization. Unlike other fields in the codebase that use default value patterns (e.g., ), these function pointers must be explicitly set or the program will crash.\n\nNote: A grep search confirms the struct is publicly exported () and re-exported through ), but no code actually instantiates it — suggesting it may be dead code. However, as a public API, it represents a hazard.\n\n## 🛠️ Proposed Fix\n\nOption 1 (preferred): Remove the struct entirely since it appears unused and introduces a dangerous API:\n\n\nOption 2: Add null-check-safe no-op defaults to prevent segfaults:\n\n\nOption 3: If this is intentional for the builder pattern, add a doc comment explicitly warning that the caller MUST initialize these fields.\n\n## ✅ Acceptance Criteria\n- [ ] passes with no regressions\n- [ ] struct either removed or made safe against null pointer dereference\n- [ ] No code path exists where or can be called as null function pointers\n- [ ] Verified is not used by any caller in the codebase before removing\n\n## 📚 References\n- Zig standard library pattern for optional function pointers: https://ziglang.org/documentation/master/#Optionals\n- Issue #714 (related): - another UI correctness issue\n- Issue #713 (related): vtable dead code - similar API design concern

[github-actions]

Based on my analysis of the codebase, I can confirm the audit finding is valid.

Analysis

Location confirmed: modules/engine-ui/src/ui_system.zig:72-93

pub const Widget = struct {
    bounds: Rect,
    visible: bool = true,
    enabled: bool = true,

    // Virtual functions
    drawFn: *const fn (*Widget) void,           // NOT optional - no default
    handleInputFn: *const fn (*Widget, InputEvent) bool,  // NOT optional - no default

    pub fn draw(self: *Widget, widget: *Widget) void {
        if (self.visible) {
            self.drawFn(widget);  // Would segfault if drawFn is uninitialized
        }
    }
    ...
};

Validation:

• drawFn and handleInputFn are non-optional function pointers with no default values
• I searched the entire codebase — zero instantiations of Widget{} found
• The struct is publicly exported (engine-ui:root.zig:35, engine/ui/ui_system.zig:6) but appears to be dead code

This is a Bug — a latent segfault vector in public API.

Recommended action: Since no code uses Widget, Option 1 (remove the struct entirely) is the cleanest fix. However, if it's intended for future use, Option 2 (use ?*const fn with null defaults and add null-checks) would make it safe.

Would you like me to proceed with removal, or do you have more context on the intended use of this struct?

opencode session  |  github run