Fix: fix SIGSEGV/SIGBUS crash in macOS keyboard functions #751
+13
−2
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
Fix SIGSEGV/SIGBUS crashes in macOS keyboard functions.
Fixes: #690, #732, #486
Related Issues Analysis
_Cfunc_keyCodeForChar()when callingKeyTap/KeyToggle/KeyUp/KeyDown0x8in_Cfunc_keyCodeForChar(0x76)when callingKeyTap("v","cmd")keyCodeForChar()Common pattern: All three issues crash at the same location (
keyCodeForChar) with SIGSEGV at address0x8, which is the signature of stack corruption from writing 8 bytes into a 2-byte variable.Root Cause
In
keyCodeForChar(), the code passes aCGKeyCode*(2 bytes) toCFDictionaryGetValueIfPresent()which expectsconst void**(8 bytes on 64-bit). This overwrites adjacent stack memory, causing crashes when critical data is affected.Technical details with official documentation:
CGKeyCodeis defined asUInt16(16-bit / 2 bytes)CFDictionaryGetValueIfPresent()third parameter isconst void**, which writes a pointer-sized valueWhen
CFDictionaryGetValueIfPresent()writes 8 bytes into a 2-byteCGKeyCodevariable, it corrupts 6 bytes of adjacent stack memory.The crash manifests on different macOS configurations depending on stack layout (compiler version, optimization level, ABI). Affected reports span:
Changes
key/keycode_c.h:keyCodeForChar(): Use pointer-sized variable forCFDictionaryGetValueIfPresent()createStringForKey(): Add NULL check forTISCopyCurrentKeyboardLayoutInputSource()and fix memory leak whenlayoutDatais nilTISGetInputSourcePropertycan return NULL with certain input methods (e.g., Japanese keyboards). See Apple Developer Forums discussion.References
Testing
Signed-off-by: PekingSpades [email protected]
Summary by CodeRabbit
✏️ Tip: You can customize this high-level summary in your review settings.