Security risk

Affected files:
react-native-svg/apple/Text/RNSVGTSpan.m
878: CFIndex runGlyphCount = CTRunGetGlyphCount(run);

react-native-svg/apple/Text/RNSVGTSpan.m
880: CGSize advances[runGlyphCount];

react-native-svg/apple/Text/RNSVGTSpan.m
878: CFIndex runGlyphCount = CTRunGetGlyphCount(run);

react-native-svg/apple/Text/RNSVGTSpan.m
879: CFIndex indices[runGlyphCount];

react-native-svg/apple/Text/RNSVGTSpan.m
878: CFIndex runGlyphCount = CTRunGetGlyphCount(run);

react-native-svg/apple/Text/RNSVGTSpan.m
881: CGGlyph glyphs[runGlyphCount];

react-native-svg/apple/Text/RNSVGTSpan.m
891: CFIndex nextRunGlyphCount = CTRunGetGlyphCount(nextRun);

react-native-svg/apple/Text/RNSVGTSpan.m
892: CFIndex nextIndices[nextRunGlyphCount];

Risks:
An attacker specifies a large number where the program is expecting signed numbers, the program interprets it as a negative number. The program checks if the buffer size is not too big, and the test passes. Then, the program, allocates a buffer of that size, causing the memory allocation to fail or causing a heap overflow if the allocation succeeds. For more information see section “Avoiding Integer Overflows and Underflows” in “Apple Secure Coding Guide” document: https://developer.apple.com/library/ios/documentation/Security/Conceptual/SecureCodingGuide/

If the size of a buffer is calculated using data supplied by the user, there is the potential for a malicious user to enter a number that is too large for the integer data type, which can cause program crashes and other problems.

Start in react-native-svg/apple/Text/RNSVGTSpan.m at the listed CTRunGetGlyphCount calls and variable-length buffer declarations. Trace how glyph counts are obtained and used, then verify that unusually large values cannot produce unsafe buffer sizes; done when the reported risk is addressed and the affected behavior is covered by validation or tests.