Fix crash: guard DrawingContext against a null image buffer (SIGSEGV)#2217
Open
ankuper wants to merge 1 commit into
Open
Fix crash: guard DrawingContext against a null image buffer (SIGSEGV)#2217ankuper wants to merge 1 commit into
ankuper wants to merge 1 commit into
Conversation
ASCGImageBuffer.initWithLength: calls malloc(length) with no null check. When length is oversized (e.g. from a bad drawingSize during chat photo layout), malloc can return NULL. CGContext(data: nil, ...) silently succeeds anyway — CoreGraphics falls back to its own internally-managed buffer, masking the failure. The later memset(self.bytes, 0, self.length) in DrawingContext.init then writes through the null imageBuffer pointer and segfaults (confirmed via crash report: ESR = Data Abort byte write Translation fault, FAR = 0x0, __bzero on the stack, ASCGImageBuffer visible in nearby registers — device crash while scrolling chats, build 33193). Fail the init gracefully (return nil) as soon as the buffer comes back null, matching the other guarded failure paths already in this initializer (non-positive size, CGContext creation failure).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
ASCGImageBuffer.initWithLength:callsmalloc(length)with no null check. Whenlengthis oversized (e.g. from a baddrawingSizecomputed during chat photo layout),malloccan returnNULL.CGContext(data: nil, ...)insideDrawingContext.initsilently succeeds anyway — CoreGraphics falls back to its own internally-managed buffer, masking the allocation failure. The latermemset(self.bytes, 0, self.length)in the same initializer then writes through the still-nullimageBuffer.mutableBytespointer and segfaults.Confirmed via an on-device crash report:
ESR = Data Abort, byte write Translation fault,FAR (fault address) = 0x0, with__bzeroandASCGImageBuffervisible in nearby registers — a real device crash while scrolling a chat with photos.Fix
Fail the initializer gracefully (
return nil) as soon as the buffer allocation comes back null, matching the other guarded failure paths already present in this same initializer (non-positive size,CGContextcreation failure). Callers ofDrawingContext.initalready handle anilresult throughout the codebase.Testing
Verified against the crash report that triggered this (register state showed a null-pointer write inside
memset/ASCGImageBuffer). Built and ran on-device (iPhone, iOS 26.5) across normal chat/photo usage after the fix; no functional regression, no follow-up allocation-related crashes observed.