bindingx icon indicating copy to clipboard operation
bindingx copied to clipboard

Heap Overflow in colorAsString: method

Open tatowilson opened this issue 6 years ago • 0 comments

https://github.com/alibaba/bindingx/blob/872f11edcc047c4b72a551ff0cd4fd7d4667b2d9/weex/ios/Sources/EBUtility%2BWX.m#L253-L259

According to doc of CGColorGetComponents:

Return Value An array of intensity values for the color components (including alpha) associated with the specified color. The size of the array is one more than the number of components of the color space for the color.

The size of the return array should not be assumed larger than or equal to 4, or it may lead to heap overflow.

There exists a function named CGColorGetNumberOfComponents, and its doc says:

Return Value The number of color components (including alpha) associated with the specified color. This number is one more than the number of components of the color space for the color.

The size of the return array depends on the color space, which has different models defined in CGColorSpaceModel, and some model(eg. kCGColorSpaceModelMonochrome) has number of color components less than 4.

tatowilson avatar Dec 21 '18 10:12 tatowilson