search

onevcat / APNGKit

High performance and delightful way to play with APNG format in iOS.
MIT License
2.22k stars 201 forks source link

Prevent process abortion in libapng #105

Closed axl411 closed 4 years ago

axl411 commented 4 years ago

This is a discussion about an issue I had in APNGKit. I think it would be easier to have a discussion based on the PR.

setjmp, longjmp

It seems this code is trying to save the program from a longjmp inside libapng: https://github.com/onevcat/APNGKit/blob/704d1b58cf9ccc284d0c150e76bbcf2b5745c575/APNGKit/Disassembler.swift#L247

However, I don't think it works because png_jmpbuf(pngPointer) just returns the jmpbuf. A setjmp function call should be used, but it is no longer available in Swift for safety.

The Actual Issue

I'm having a crash in my app. I created a demo: https://github.com/axl411/APNGKitCrash

The crash happens at this line: https://github.com/onevcat/APNGKit/blob/704d1b58cf9ccc284d0c150e76bbcf2b5745c575/APNGKit/Disassembler.swift#L168

Inside libapng, the error happens at: https://github.com/onevcat/APNGKit/blob/704d1b58cf9ccc284d0c150e76bbcf2b5745c575/APNGKit/libpng-apng/pngread.c#L333

A longjmp is called at last in libapng, but since no setjmp is called earlier, the program crashes.