RawProps::at(name, prefix, suffix) leaves RawPropsParser a view of a destroyed key

Aberta
  • Algo errado?
#59,327 2 comentários 0 reações 0 responsáveis Ver no GitHub

Mantenedores costumam responder em até 2 dias

Ninguém assumiu esta issue ainda.

  • #59479 de @Shubham-Padkonde — fechado sem integrar

Avaliação

Dificuldade
3/5
Tempo estimado
1-2 dias
Facilidade para iniciantes
55/100
Tipo de issue
Bug
Clareza
Claramente especificada
Status de atividade
Ativa
Stack de tecnologia
android, cpp, ios
Domínio
backend, mobile

Direção de pesquisa

Read packages/react-native/ReactCommon/react/renderer/core/RawProps.cpp and RawPropsParser.cpp, especially the RawProps::at overload and how RawPropsParser stores and uses keys. Start by running the linked AddressSanitizer reproducer against ReactCommon. Done means the prefix/suffix lookups no longer access freed memory; verify the reproducer's heap and stack use-after-return cases.

Escrita pelo modelo de indexação a partir do texto da issue.

Descrição

Needs: Attention Needs: Repro
Description

RawProps::at(name, prefix, suffix), which #57346 added back for callers that pass a prefix and a suffix apart, builds prefix + name + suffix in a local std::string and passes RawPropsParser::at a std::string_view of it (RawProps.cpp). While the parser is being prepared, it stores that view in keys_ (RawPropsParser.cpp), and the string is destroyed as RawProps::at returns. The next lookup's duplicate check compares against the stored view, and so does every lookup's cursor loop once the parser is ready. A props constructor that passes a prefix or a suffix therefore reads freed memory: the heap's for a key longer than std::string's inline buffer, a returned stack frame's for a shorter one.

No caller in this repository passes a prefix or a suffix, and Nitro's generated views pass nullptr for both, which the overload forwards to at(name).

Steps to reproduce
  1. In a react-native checkout at main, unpack the third-party sources ReactAndroid builds against: its prepareBoost, prepareDoubleConversion, prepareFastFloat, prepareFmt, prepareFolly and prepareGlog tasks write them to packages/react-native/ReactAndroid/build/third-party-ndk, as any ReactAndroid build does.
  2. Clone the reproducer and run its CC=clang CXX=clang++ ./run.sh <checkout> with a clang that has libc++. It compiles RawProps.cpp, RawPropsParser.cpp, RawPropsKeyMap.cpp and jsi under AddressSanitizer, with folly built as Fantom's tester builds it.
  3. main.cpp makes the two lookups a props constructor makes while its parser is prepared, at("Width", prefix, nullptr) and then at("Color", prefix, nullptr). With a prefix that puts the key on the heap, AddressSanitizer reports a heap-use-after-free in RawPropsParser::at; with border and detect_stack_use_after_return=1, a stack-use-after-return.

Expected: AddressSanitizer reports nothing; the parser keeps no view of a string that at destroys.
Actual: the heap-use-after-free and the stack-use-after-return of step 3.

React Native Version

0.88.0

Affected Platforms

Other (please specify)

Output of npx @react-native-community/cli info
Not an app. The reproducer compiles ReactCommon from a react-native checkout at 79a562960d
(0.87.0 and 0.88.0 have the same RawProps::at), on Ubuntu 24.04.5 LTS with clang 21.1.8,
libc++ 21, CMake 3.28.3 and Ninja 1.11.1. ReactCommon is shared by Android and iOS.
Stacktrace or Logs
==877045==ERROR: AddressSanitizer: heap-use-after-free on address 0x6c82c09e0010 at pc 0x5624bcc650a6 bp 0x7ffd3d3309a0 sp 0x7ffd3d330148
READ of size 27 at 0x6c82c09e0010 thread T0
    …
    #5 0x5624bcd620de in facebook::react::RawPropsParser::at(facebook::react::RawProps const&, std::__1::basic_string_view<char, std::__1::char_traits<char>>) const packages/react-native/ReactCommon/react/renderer/core/RawPropsParser.cpp:36:20
    #6 0x5624bcd5ecf0 in facebook::react::RawProps::at(char const*, char const*, char const*) const packages/react-native/ReactCommon/react/renderer/core/RawProps.cpp:138:19
    #7 0x5624bcd30937 in main main.cpp:22:12
    …
freed by thread T0 here:
    …
    #4 0x5624bcd5ed0c in std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>>::~basic_string() <libc++>/string:1207:7
    #5 0x5624bcd5ed0c in facebook::react::RawProps::at(char const*, char const*, char const*) const packages/react-native/ReactCommon/react/renderer/core/RawProps.cpp:139:1
    #6 0x5624bcd30923 in main main.cpp:21:12
    …
previously allocated by thread T0 here:
    …
    #8 0x5624bcd5e944 in facebook::react::RawProps::at(char const*, char const*, char const*) const packages/react-native/ReactCommon/react/renderer/core/RawProps.cpp:131:16
    #9 0x5624bcd30923 in main main.cpp:21:12
    …
SUMMARY: AddressSanitizer: heap-use-after-free (rawprops_freed_key+0x6c0a5) (BuildId: 455eeab6b3b568f6efa9de9b34b3f5910f33230f) in MemcmpInterceptorCommon(void*, int (*)(void const*, void const*, unsigned long), void const*, void const*, unsigned long)

==877057==ERROR: AddressSanitizer: stack-use-after-return on address 0x78b02dc00021 at pc 0x5c1bcb3c70a6 bp 0x7ffe1260aee0 sp 0x7ffe1260a688
READ of size 11 at 0x78b02dc00021 thread T0
    …
    #5 0x5c1bcb4c40de in facebook::react::RawPropsParser::at(facebook::react::RawProps const&, std::__1::basic_string_view<char, std::__1::char_traits<char>>) const packages/react-native/ReactCommon/react/renderer/core/RawPropsParser.cpp:36:20
    #6 0x5c1bcb4c0cf0 in facebook::react::RawProps::at(char const*, char const*, char const*) const packages/react-native/ReactCommon/react/renderer/core/RawProps.cpp:138:19
    …
SUMMARY: AddressSanitizer: stack-use-after-return (rawprops_freed_key+0x6c0a5) (BuildId: 455eeab6b3b568f6efa9de9b34b3f5910f33230f) in MemcmpInterceptorCommon(void*, int (*)(void const*, void const*, unsigned long), void const*, void const*, unsigned long)
MANDATORY Reproducer

https://github.com/YevheniiKotyrlo/rawprops-prefixed-key-freed

Linguagem predominante
C++
Estrelas
127k
Forks
25.4k
Merge médio
3d 1h
PRs com merge (30d)
108

Preparar o ambiente

Primeiros passos

  1. Leia a issue inteira e depois o guia de contribuição do projeto.
  2. Comente na issue dizendo que vai assumir — evita que duas pessoas façam o mesmo trabalho.
  3. Faça um fork do repositório e trabalhe em uma branch.
  4. Abra um pull request que referencie o número da issue.

Mais de react/react-native

Todas as issues de react/react-native

Issues semelhantes

Mais issues de C++

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.