Skip to content

Conversation

@PekingSpades
Copy link

Summary

Fix memory safety issues in KeyCodeConverter.m:

  • Add NULL checks for CFStringCreateWithCharacters return value
  • Add NULL checks for TISCopyCurrentKeyboardInputSource and TISGetInputSourceProperty return values to prevent crashes
  • Fix pointer size mismatch in CFDictionaryGetValueIfPresent call that could cause stack corruption on 64-bit systems

Problem

The keyCodeForChar function has a critical bug: it passes a pointer to CGKeyCode (which is uint16_t, 2 bytes) to CFDictionaryGetValueIfPresent, but this function writes a pointer-sized value (8 bytes on 64-bit systems). This causes stack overflow and corrupts adjacent memory.

Additionally, several CoreFoundation functions that can return NULL were not checked before use, which could lead to crashes.

Changes

  1. keyCodeForChar function:

    • Added NULL check for charStr after CFStringCreateWithCharacters
    • Changed from (const void **)&code to using a proper pointer-sized variable codeValue, then safely casting to CGKeyCode
  2. createStringForKey function:

    • Added NULL check for TISCopyCurrentKeyboardInputSource return value
    • Added NULL check for TISGetInputSourceProperty return value with proper cleanup of currentKeyboard

References

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant