Telegram-iOS/submodules/TelegramUI
ankuper 77de8a26c4 fix(animation-cache): stop caching a dangling withUnsafeBytes pointer
DecompressedData.init derives src_ptr/src_size from a Data.withUnsafeBytes
closure and stashes it into stream.pointee for later use across many
read(bytes:count:) calls. Data's documentation is explicit that the
pointer handed to withUnsafeBytes is only valid for the duration of that
closure — Data's backing storage can move or be deallocated once it
returns, leaving src_ptr dangling for every read() call after init.

compression_stream_process then reads through that dangling pointer,
corrupting the heap; malloc's own consistency checks catch the corruption
later and abort() (confirmed on-device: SIGABRT inside
libsystem_malloc.dylib, queue DCTMultiAnimationRenderer-FirstFrame,
build 33196, ~40s after launch — loading the first frame of an animated
sticker/emoji).

Re-derive a live pointer inside a fresh withUnsafeBytes call on every
read(), tracking how many source bytes compression_stream_process has
already consumed (consumedSrcBytes) so each call resumes from the right
offset. compression_stream_process's own src_size/dst_size bookkeeping is
unchanged; only the pointer's lifetime handling is fixed.
2026-07-02 17:53:19 -04:00
..
Components fix(animation-cache): stop caching a dangling withUnsafeBytes pointer 2026-07-02 17:53:19 -04:00
Images.xcassets Various fixes 2026-05-31 17:35:32 +02:00
Resources Various fixes 2026-04-28 19:16:08 +02:00
Sounds
Sources Rich-message media in gallery/shared-media/preview pipelines via Message.effectiveMedia 2026-06-04 23:46:56 +02:00
.gitignore
BUILD Various improvements 2026-05-28 16:50:05 +02:00