Skip to content

Safely copy MIMEType to prevent use after free (Issue #14734) #15313

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Sep 11, 2025
Merged

Safely copy MIMEType to prevent use after free (Issue #14734) #15313

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
746d8fb
Safely copy MIMEType to prevent use after fre
JesusRojass Sep 10, 2025
40e19d5
Fix Styling and applied review suggestions
JesusRojass Sep 10, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion FirebasePerformance/Sources/Instrumentation/FPRNetworkTrace.m
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -251,7 +251,9 @@ - (void)didCompleteRequestWithResponse:(NSURLResponse *)response error:(NSError
self.responseCode = (int32_t)HTTPResponse.statusCode;
}
self.responseError = error;
self.responseContentType = response.MIMEType;
// Safely copy MIMEType to prevent use after free
NSString *mime = [response.MIMEType copy];
self.responseContentType = (mime.length ? mime : nil);
Comment on lines +254 to +256
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks, @JesusRojass, for investigating! I'm unsure if this approach addresses the issue. The crash happens in the call to MIMEType, so the subsequent copy won't run (3 CFNetwork 0x32c9c URLResponse::getMIMEType() + 60).

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I still have doubts that this is fixes the crash in the linked issue, but I think this is a great improvement that makes this logic more resilient and explicit, so we can merge as-is and continue to monitor the original issue for any changes.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I have another more defensive idea to address the crash because I never thought of it that way

just waiting on my local unit tests to run before commiting

[self checkpointState:FPRNetworkTraceCheckpointStateResponseCompleted];

// Send the network trace for logging.
Expand Down
Loading