adobe / adobe/XMP-Toolkit-SDK

Crashes in InsertInDefaultNameSpacePrefixMap

Open
#101 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
C++
Stars
262
Forks
110
PR merge metrics
No merged PRs in 30d

Description

Hi all,

We're using the latest version (v2023.12) on an iOS app, and we're seeing random crashes (segmentation faults) with the following stack:

```
Thread 12 Crashed:

0 Switcher 0x0000000103bcdd04 AdobeXMPCore_Int::INameSpacePrefixMap_I::InsertInDefaultNameSpacePrefixMap(char const*, unsigned long long, char const*, unsigned long long) + 19881220 (NameSpacePrefixMapImpl.cpp:286)
1 Switcher 0x0000000103becaec XMPMeta::RegisterNamespace(char const*, char const*, char const**, unsigned int*) + 20007660 (XMPMeta.cpp:1062)
2 Switcher 0x0000000103c1f948 addBinding + 20216136 (xmlparse.c:0)
3 Switcher 0x0000000103c1e734 storeAtts + 20211508 (xmlparse.c:0)
4 Switcher 0x0000000103c1d998 doContent + 20208024 (xmlparse.c:2962)
5 Switcher 0x0000000103c1c728 contentProcessor + 20203304 (xmlparse.c:2621)
6 Switcher 0x0000000103c1c204 prologProcessor + 20201988 (xmlparse.c:4607)
7 Switcher 0x0000000103c1ac34 XML_ParseBuffer + 20196404 (xmlparse.c:2018)
8 Switcher 0x0000000103bb8780 ExpatAdapter::ParseBuffer(void const*, unsigned long, bool) + 19793792 (ExpatAdapter.cpp:154)
9 Switcher 0x0000000103be863c ProcessUTF8Portion(XMLParserAdapter*, unsigned char const*, unsigned long, bool) + 19990076 (XMPMeta-Parse.cpp:1027)
10 Switcher 0x0000000103be81fc XMPMeta::ProcessXMLBuffer(char const*, unsigned int, bool) + 19988988 (XMPMeta-Parse.cpp:1168)
11 Switcher 0x0000000103be88ac XMPMeta::ParseFromBuffer(char const*, unsigned int, unsigned int) + 19990700 (XMPMeta-Parse.cpp:1250)
12 Switcher 0x0000000103bddf10 WXMPMeta_ParseFromBuffer_1 + 19947280 (WXMPMeta.cpp:1203)
13 Switcher 0x00000001029691b8 TXMPMeta, std::__1::allocator>>::ParseFromBuffer(char const*, unsigned int, unsigned int) + 594360 (TXMPMeta.incl_cpp:861)
14 Switcher 0x0000000103c432dc PNG_MetaHandler::ProcessXMP() + 20361948 (PNG_Handler.cpp:0)
15 Switcher 0x0000000103ca41ec XMPFiles::GetXMP(TXMPMeta, std::__1::allocator>>*, char const**, unsigned int*, XMP_PacketInfo*) + 20759020 (XMPFiles.cpp:1511)
16 Switcher 0x0000000103ca2cdc WXMPFiles_GetXMP_1 + 20753628 (WXMPFiles.cpp:0)
17 Switcher 0x000000010296ab5c TXMPFiles, std::__1::allocator>>::GetXMP(TXMPMeta, std::__1::allocator>>*, std::__1::basic_string, std::__1::allocator>*, XMP_PacketInfo*) + 600924 (TXMPFiles.incl_cpp:382)
18 Switcher 0x000000010296adb8 _read(char const*, unsigned int, swixmp_metadata**) + 601528 (swixmp.cpp:142)
```

Here's our code in the _read function:
```
XMP_OptionBits opts = kXMPFiles_OpenForRead | kXMPFiles_OpenStrictly;
SXMPFiles f;
SXMPMeta xmp;

try {
if (!f.OpenFile(path, format, opts)) {
printf("swixmp: _read: failed to open file: %s\n", path);
return SWIXMP_RESULT_CANNOT_OPEN;
}

f.GetXMP(&xmp);
```

The crash is in NameSpacePrefixMapImpl.cpp line 286:

```
bool INameSpacePrefixMap_I::InsertInDefaultNameSpacePrefixMap( const char * prefix, sizet prefixLength, const char * nameSpace, sizet nameSpaceLength ) {
return ManageDefaultNameSpacePrefixMap( false )->Insert( prefix, prefixLength, nameSpace, nameSpaceLength );
}
```

It looks like `ManageDefaultNameSpacePrefixMap( false )` is returning an invalid pointer, and the value is not checked before calling `Insert`.

Contributor guide

Open the contributing guide

Research direction

Start with NameSpacePrefixMapImpl.cpp:286 and trace ManageDefaultNameSpacePrefixMap(false) through the XML parsing path shown in XMPMeta-Parse.cpp, ExpatAdapter.cpp, and PNG_Handler.cpp. Use the reported iOS stack and _read flow as the reproduction context. Done means the invalid-pointer crash is explained and the parsing path no longer crashes under the triggering input.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
tooling
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
32/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.