bindingx
bindingx copied to clipboard
Heap Overflow in colorAsString: method
https://github.com/alibaba/bindingx/blob/872f11edcc047c4b72a551ff0cd4fd7d4667b2d9/weex/ios/Sources/EBUtility%2BWX.m#L253-L259
According to doc of CGColorGetComponents:
Return Value An array of intensity values for the color components (including alpha) associated with the specified color. The size of the array is one more than the number of components of the color space for the color.
The size of the return array should not be assumed larger than or equal to 4, or it may lead to heap overflow.
There exists a function named CGColorGetNumberOfComponents, and its doc says:
Return Value The number of color components (including alpha) associated with the specified color. This number is one more than the number of components of the color space for the color.
The size of the return array depends on the color space, which has different models defined in CGColorSpaceModel, and some model(eg. kCGColorSpaceModelMonochrome) has number of color components less than 4.