From 92cb639713deebae39570f4a7f445f88bf34bed7 Mon Sep 17 00:00:00 2001 From: DreamPiggy Date: Sat, 16 Feb 2019 16:06:24 +0800 Subject: [PATCH] Fix that WebP with custom ICC Profile will randomly crash, because `CGColorSpaceCreateWithICCProfile` does not copy the ICC data pointer, previous code cause a use-after-free issue --- SDWebImageWebPCoder/Classes/SDImageWebPCoder.m | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/SDWebImageWebPCoder/Classes/SDImageWebPCoder.m b/SDWebImageWebPCoder/Classes/SDImageWebPCoder.m index 99116fd..fae88be 100644 --- a/SDWebImageWebPCoder/Classes/SDImageWebPCoder.m +++ b/SDWebImageWebPCoder/Classes/SDImageWebPCoder.m @@ -429,7 +429,9 @@ WebPChunkIterator chunk_iter; int result = WebPDemuxGetChunk(demuxer, "ICCP", 1, &chunk_iter); if (result) { - NSData *profileData = [NSData dataWithBytesNoCopy:(void *)chunk_iter.chunk.bytes length:chunk_iter.chunk.size freeWhenDone:NO]; + // See #2618, the `CGColorSpaceCreateWithICCProfile` does not copy ICC Profile data, it only retain the byte ptr. + // When the libwebp `WebPDemuxer` dealloc, all chunk will be freed. So we must copy the ICC data (really cheap, less than 10KB) + NSData *profileData = [NSData dataWithBytes:chunk_iter.chunk.bytes length:chunk_iter.chunk.size]; colorSpaceRef = CGColorSpaceCreateWithICCProfile((__bridge CFDataRef)profileData); WebPDemuxReleaseChunkIterator(&chunk_iter); }