RawProps::at(name, prefix, suffix) leaves RawPropsParser a view of a destroyed key

Offen
  • Stimmt etwas nicht?
#59,327 2 Kommentare 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen

Maintainer antworten meist innerhalb von 2 Tagen

Dieses Issue hat noch niemand übernommen.

  • #59479 von @Shubham-Padkonde — ohne Merge geschlossen

Bewertung

Schwierigkeit
3/5
Geschätzter Aufwand
1-2 Tage
Anfängerfreundlichkeit
55/100
Issue-Typ
Bug
Klarheit
Klar beschrieben
Aktivitätsstatus
Aktiv
Tech-Stack
android, cpp, ios
Bereich
backend, mobile

Rechercherichtung

Read packages/react-native/ReactCommon/react/renderer/core/RawProps.cpp and RawPropsParser.cpp, especially the RawProps::at overload and how RawPropsParser stores and uses keys. Start by running the linked AddressSanitizer reproducer against ReactCommon. Done means the prefix/suffix lookups no longer access freed memory; verify the reproducer's heap and stack use-after-return cases.

Vom Indexierungsmodell aus dem Issue-Text verfasst.

Beschreibung

Needs: Attention Needs: Repro
Description

RawProps::at(name, prefix, suffix), which #57346 added back for callers that pass a prefix and a suffix apart, builds prefix + name + suffix in a local std::string and passes RawPropsParser::at a std::string_view of it (RawProps.cpp). While the parser is being prepared, it stores that view in keys_ (RawPropsParser.cpp), and the string is destroyed as RawProps::at returns. The next lookup's duplicate check compares against the stored view, and so does every lookup's cursor loop once the parser is ready. A props constructor that passes a prefix or a suffix therefore reads freed memory: the heap's for a key longer than std::string's inline buffer, a returned stack frame's for a shorter one.

No caller in this repository passes a prefix or a suffix, and Nitro's generated views pass nullptr for both, which the overload forwards to at(name).

Steps to reproduce
  1. In a react-native checkout at main, unpack the third-party sources ReactAndroid builds against: its prepareBoost, prepareDoubleConversion, prepareFastFloat, prepareFmt, prepareFolly and prepareGlog tasks write them to packages/react-native/ReactAndroid/build/third-party-ndk, as any ReactAndroid build does.
  2. Clone the reproducer and run its CC=clang CXX=clang++ ./run.sh <checkout> with a clang that has libc++. It compiles RawProps.cpp, RawPropsParser.cpp, RawPropsKeyMap.cpp and jsi under AddressSanitizer, with folly built as Fantom's tester builds it.
  3. main.cpp makes the two lookups a props constructor makes while its parser is prepared, at("Width", prefix, nullptr) and then at("Color", prefix, nullptr). With a prefix that puts the key on the heap, AddressSanitizer reports a heap-use-after-free in RawPropsParser::at; with border and detect_stack_use_after_return=1, a stack-use-after-return.

Expected: AddressSanitizer reports nothing; the parser keeps no view of a string that at destroys.
Actual: the heap-use-after-free and the stack-use-after-return of step 3.

React Native Version

0.88.0

Affected Platforms

Other (please specify)

Output of npx @react-native-community/cli info
Not an app. The reproducer compiles ReactCommon from a react-native checkout at 79a562960d
(0.87.0 and 0.88.0 have the same RawProps::at), on Ubuntu 24.04.5 LTS with clang 21.1.8,
libc++ 21, CMake 3.28.3 and Ninja 1.11.1. ReactCommon is shared by Android and iOS.
Stacktrace or Logs
==877045==ERROR: AddressSanitizer: heap-use-after-free on address 0x6c82c09e0010 at pc 0x5624bcc650a6 bp 0x7ffd3d3309a0 sp 0x7ffd3d330148
READ of size 27 at 0x6c82c09e0010 thread T0
    …
    #5 0x5624bcd620de in facebook::react::RawPropsParser::at(facebook::react::RawProps const&, std::__1::basic_string_view<char, std::__1::char_traits<char>>) const packages/react-native/ReactCommon/react/renderer/core/RawPropsParser.cpp:36:20
    #6 0x5624bcd5ecf0 in facebook::react::RawProps::at(char const*, char const*, char const*) const packages/react-native/ReactCommon/react/renderer/core/RawProps.cpp:138:19
    #7 0x5624bcd30937 in main main.cpp:22:12
    …
freed by thread T0 here:
    …
    #4 0x5624bcd5ed0c in std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>>::~basic_string() <libc++>/string:1207:7
    #5 0x5624bcd5ed0c in facebook::react::RawProps::at(char const*, char const*, char const*) const packages/react-native/ReactCommon/react/renderer/core/RawProps.cpp:139:1
    #6 0x5624bcd30923 in main main.cpp:21:12
    …
previously allocated by thread T0 here:
    …
    #8 0x5624bcd5e944 in facebook::react::RawProps::at(char const*, char const*, char const*) const packages/react-native/ReactCommon/react/renderer/core/RawProps.cpp:131:16
    #9 0x5624bcd30923 in main main.cpp:21:12
    …
SUMMARY: AddressSanitizer: heap-use-after-free (rawprops_freed_key+0x6c0a5) (BuildId: 455eeab6b3b568f6efa9de9b34b3f5910f33230f) in MemcmpInterceptorCommon(void*, int (*)(void const*, void const*, unsigned long), void const*, void const*, unsigned long)

==877057==ERROR: AddressSanitizer: stack-use-after-return on address 0x78b02dc00021 at pc 0x5c1bcb3c70a6 bp 0x7ffe1260aee0 sp 0x7ffe1260a688
READ of size 11 at 0x78b02dc00021 thread T0
    …
    #5 0x5c1bcb4c40de in facebook::react::RawPropsParser::at(facebook::react::RawProps const&, std::__1::basic_string_view<char, std::__1::char_traits<char>>) const packages/react-native/ReactCommon/react/renderer/core/RawPropsParser.cpp:36:20
    #6 0x5c1bcb4c0cf0 in facebook::react::RawProps::at(char const*, char const*, char const*) const packages/react-native/ReactCommon/react/renderer/core/RawProps.cpp:138:19
    …
SUMMARY: AddressSanitizer: stack-use-after-return (rawprops_freed_key+0x6c0a5) (BuildId: 455eeab6b3b568f6efa9de9b34b3f5910f33230f) in MemcmpInterceptorCommon(void*, int (*)(void const*, void const*, unsigned long), void const*, void const*, unsigned long)
MANDATORY Reproducer

https://github.com/YevheniiKotyrlo/rawprops-prefixed-key-freed

Vorherrschende Sprache
C++
Sterne
127k
Forks
25.4k
Ø Merge
3 T. 1 Std.
Gemergte PRs (30 T.)
108

Entwicklungsumgebung

Erste Schritte

  1. Lesen Sie das ganze Issue und danach den Beitragsleitfaden des Projekts.
  2. Schreiben Sie ins Issue, dass Sie es übernehmen — das erspart doppelte Arbeit.
  3. Forken Sie das Repository und arbeiten Sie in einem Branch.
  4. Öffnen Sie einen Pull Request, der die Issue-Nummer nennt.

Mehr aus react/react-native

Alle Issues in react/react-native

Ähnliche Issues

Weitere Issues zu C++

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.