Skip to content

Commit 92cb639

Browse files
committed
Fix that WebP with custom ICC Profile will randomly crash, because CGColorSpaceCreateWithICCProfile does not copy the ICC data pointer, previous code cause a use-after-free issue
1 parent b4b3504 commit 92cb639

File tree

1 file changed

+3
-1
lines changed

1 file changed

+3
-1
lines changed

SDWebImageWebPCoder/Classes/SDImageWebPCoder.m

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -429,7 +429,9 @@ - (nonnull CGColorSpaceRef)sd_colorSpaceWithDemuxer:(nonnull WebPDemuxer *)demux
429429
WebPChunkIterator chunk_iter;
430430
int result = WebPDemuxGetChunk(demuxer, "ICCP", 1, &chunk_iter);
431431
if (result) {
432-
NSData *profileData = [NSData dataWithBytesNoCopy:(void *)chunk_iter.chunk.bytes length:chunk_iter.chunk.size freeWhenDone:NO];
432+
// See #2618, the `CGColorSpaceCreateWithICCProfile` does not copy ICC Profile data, it only retain the byte ptr.
433+
// When the libwebp `WebPDemuxer` dealloc, all chunk will be freed. So we must copy the ICC data (really cheap, less than 10KB)
434+
NSData *profileData = [NSData dataWithBytes:chunk_iter.chunk.bytes length:chunk_iter.chunk.size];
433435
colorSpaceRef = CGColorSpaceCreateWithICCProfile((__bridge CFDataRef)profileData);
434436
WebPDemuxReleaseChunkIterator(&chunk_iter);
435437
}

0 commit comments

Comments
 (0)