status-im
/
react-native
mirror of https://github.com/status-im/react-native.git
2
0
Fork 0
Code Issues Projects Releases Wiki Activity

Read within bounds of `NSData` object 

Summary: This prevents the `isUnbundle` check to read beyond the end of an `NSData` instance by using `getBytes:length:` instead of accessing the underlying buffer directly.

Reviewed By: javache

Differential Revision: D3548874

fbshipit-source-id: 7c93c66cc6abb4a2a321888ab394212f4d14a03e
This commit is contained in:
David Aurelio 2016-07-12 10:11:42 -07:00 committed by Facebook Github Bot 3
parent 0d3c4f8e5e
commit c33084cc94
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
React/Executors/RCTJSCExecutor.mm
View File

@ -730,8 +730,9 @@ static NSData *loadPossiblyBundledApplicationScript(NSData *script, NSURL *sourc
NSError **error) NSError **error)
{ {
// The RAM bundle has a magic number in the 4 first bytes `(0xFB0BD1E5)`. // The RAM bundle has a magic number in the 4 first bytes `(0xFB0BD1E5)`.
uint32_t magicNumber = NSSwapLittleIntToHost(*((uint32_t *)script.bytes)); uint32_t magicNumber = 0;
isRAMBundle = magicNumber == RCTRAMBundleMagicNumber; [script getBytes:&magicNumber length:sizeof(magicNumber)];
isRAMBundle = NSSwapLittleIntToHost(magicNumber) == RCTRAMBundleMagicNumber;
if (isRAMBundle) { if (isRAMBundle) {
[performanceLogger markStartForTag:RCTPLRAMBundleLoad]; [performanceLogger markStartForTag:RCTPLRAMBundleLoad];
script = loadRAMBundle(sourceURL, error, randomAccessBundle); script = loadRAMBundle(sourceURL, error, randomAccessBundle);