Skip to content

Conversation

@drodriguez
Copy link
Contributor

The Swift dispatching of CFArraySetValueAtIndex had the arguments for
value and index switched around. If someone creates a Swift NSArray
which is eventually bridged to CFArray, and some other piece calls
CFArraySetValueAtIndex, CF_SWIFT_FUNCDISPATCHV will delegate to the
Swift method, but will send a pointer where CFIndex is expected, and a
CFIndex where a pointer is expected, probably causing a segmentation
fault.

The test tries to simplify the scenario (not easy to create the right
conditions) and uses unsafeBitCast (which is the same that happens in
the internal _cfObject). The test crashes before the patch is applied.

The Swift dispatching of CFArraySetValueAtIndex had the arguments for
value and index switched around. If someone creates a Swift NSArray
which is eventually bridged to CFArray, and some other piece calls
CFArraySetValueAtIndex, CF_SWIFT_FUNCDISPATCHV will delegate to the
Swift method, but will send a pointer where CFIndex is expected, and a
CFIndex where a pointer is expected, probably causing a segmentation
fault.

The test tries to simplify the scenario (not easy to create the right
conditions) and uses unsafeBitCast (which is the same that happens in
the internal _cfObject). The test crashes before the patch is applied.
@spevans
Copy link
Contributor

spevans commented Aug 31, 2018

@swift-ci test


void CFArraySetValueAtIndex(CFMutableArrayRef array, CFIndex idx, const void *value) {
CF_SWIFT_FUNCDISPATCHV(CFArrayGetTypeID(), void, (CFSwiftRef)array, NSMutableArray.setObject, idx, value);
CF_SWIFT_FUNCDISPATCHV(CFArrayGetTypeID(), void, (CFSwiftRef)array, NSMutableArray.setObject, value, idx);
Copy link
Contributor

@millenomi millenomi Aug 31, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We should really name all the arguments in order in the bridge struct field name to prevent this from occurring again. Is there any way I can convince you to add an edit so this reads NSMutableArray.setObjectAtIndex?

✅ whether this is done or not.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would prefer to do that as a different PR, if you don’t mind. It might be also kind of a big change.

Copy link
Contributor

@parkera parkera left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for catching this!

@parkera parkera merged commit 68c0749 into swiftlang:master Sep 14, 2018
@drodriguez drodriguez deleted the fix-CFArraySetValueAtIndex-swift-dispatch branch July 16, 2019 22:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants