m1entus / mzappearance Goto Github PK

XCode Build Analyzer complains "Use of Memory after it is freed" in NSInvocation+Copy.m jbb_removeObjCTypeQualifiers(const char *aType) method

    char *newString = (char *)malloc(sizeof(aType) - 1);
    strncpy(newString, aType + 1, sizeof(aType) - 1);
    const char *returnString = jbb_removeObjCTypeQualifiers(newString);
    free(newString);
    return returnString;

returnString is being used after free.

Hi,

Our static scan tool reported MZAppearance as having a security flaw in NSInvocation+Copy.m on this line. Evidently it expects the return value of malloc() to be checked or NULL.

I had intended to create a pull request for this, but am unsure what should be returned in the case that malloc() fails. The two options I see are: return NULL and update all the places that call jbb_removeObjCTypeQualifiers() to check for NULL (and then update all of them to return some value on failure), or just return aType. Obviously returning and checking for NULL would be ideal, since just return aType could put the code into an unknown state as it doesn't know that the malloc() failed. The issue with returning NULL is that it affects many other methods.

What would you suggest?

Thank you!

Would be nice to have a new release of this with carthage support included

Package.swift exists in master to enable integration with SwiftPM but is unable to be referenced until a tag or release is created that includes it.

MZAppearance doesn't support Swift Package Manager. This requires a Package.swift file at the root of the repository following the format defined in Package Description.

Using Carthage (Please add SPM support to this and MZFormSheet).

MZAppearance.framework/MZAppearance have the same architectures (arm64) and can't be in the same fat output file
Building universal frameworks with common architectures is not possible. The device and simulator slices for "MZAppearance" both build for: arm64
Rebuild with --use-xcframeworks to create an xcframework bundle instead.

I've used this in the past with great success in ObjC projects, can it work in swift environment ? I made a quick test but failed to get it working