Skip to content

fix: prevent use-after-free crash in Adobe kit _midOverride #30

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
denischilik merged 1 commit into from
Apr 21, 2026
Merged

fix: prevent use-after-free crash in Adobe kit _midOverride #30

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
52 changes: 45 additions & 7 deletions mParticle-Adobe/MPKitAdobe.m
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
#import "MPKitAdobe.h"
#import "MPIAdobe.h"
#import <os/lock.h>

static NSString *const marketingCloudIdIntegrationAttributeKey = @"mid";
static NSString *const blobIntegrationAttributeKey = @"aamb";
Expand Down Expand Up @@ -33,6 +34,40 @@ @implementation MPKitAdobe

static NSString *_midOverride = nil;
static BOOL _willOverrideMid = NO;
static os_unfair_lock _midOverrideLock = OS_UNFAIR_LOCK_INIT;

// Thread-safe accessors for the file-scope statics above.
// Direct reads/writes of `_midOverride` from multiple threads race on the
// ARC-managed retain/release of the static, which can cause a value that is
// about to be released to be captured into an NSDictionary and later trigger
// a use-after-free when the dictionary is serialized on the mParticle
// message queue.
static NSString * _Nullable MPKitAdobeCopyMidOverride(void) {
os_unfair_lock_lock(&_midOverrideLock);
NSString *snapshot = _midOverride;
os_unfair_lock_unlock(&_midOverrideLock);
return snapshot;
}

static void MPKitAdobeSetMidOverride(NSString * _Nullable value) {
NSString *copied = [value copy];
os_unfair_lock_lock(&_midOverrideLock);
_midOverride = copied;
os_unfair_lock_unlock(&_midOverrideLock);
}

static BOOL MPKitAdobeGetWillOverrideMid(void) {
os_unfair_lock_lock(&_midOverrideLock);
BOOL value = _willOverrideMid;
os_unfair_lock_unlock(&_midOverrideLock);
return value;
}

static void MPKitAdobeSetWillOverrideMid(BOOL value) {
os_unfair_lock_lock(&_midOverrideLock);
_willOverrideMid = value;
os_unfair_lock_unlock(&_midOverrideLock);
}

+ (NSNumber *)kitCode {
return @124;
Expand All @@ -47,15 +82,16 @@ + (void)load {

static __weak MPKitAdobe *_sharedInstance = nil;
+ (void)overrideMarketingCloudId:(NSString *)mid {
_midOverride = mid;
if (mid) {
[[MParticle sharedInstance] setIntegrationAttributes:@{marketingCloudIdIntegrationAttributeKey: mid} forKit:[[self class] kitCode]];
NSString *midSnapshot = [mid copy];
MPKitAdobeSetMidOverride(midSnapshot);
if (midSnapshot) {
[[MParticle sharedInstance] setIntegrationAttributes:@{marketingCloudIdIntegrationAttributeKey: midSnapshot} forKit:[[self class] kitCode]];
}
[_sharedInstance performSelectorOnMainThread:@selector(sendNetworkRequest) withObject:nil waitUntilDone:NO];
}

+ (void)willOverrideMarketingCloudId:(BOOL)willOverrideMid {
_willOverrideMid = willOverrideMid;
MPKitAdobeSetWillOverrideMid(willOverrideMid);
}

#pragma mark MPKitInstanceProtocol methods
Expand Down Expand Up @@ -140,11 +176,12 @@ - (NSString *)pushToken {
}

- (void)sendNetworkRequest {
if (_willOverrideMid && !_midOverride) {
NSString *midOverrideSnapshot = MPKitAdobeCopyMidOverride();
if (MPKitAdobeGetWillOverrideMid() && !midOverrideSnapshot) {
return;
}

NSString *marketingCloudId = _midOverride;
NSString *marketingCloudId = midOverrideSnapshot;
if (!marketingCloudId) {
marketingCloudId = [self marketingCloudIdFromIntegrationAttributes];
if (!marketingCloudId) {
Expand Down Expand Up @@ -172,9 +209,10 @@ - (void)sendNetworkRequest {
return;
}

NSString *midOverrideForCompletion = MPKitAdobeCopyMidOverride();
NSMutableDictionary *integrationAttributes = [NSMutableDictionary dictionary];
if (marketingCloudId.length) {
[integrationAttributes setObject:(_midOverride ?: marketingCloudId) forKey:marketingCloudIdIntegrationAttributeKey];
[integrationAttributes setObject:(midOverrideForCompletion ?: marketingCloudId) forKey:marketingCloudIdIntegrationAttributeKey];
}
if (locationHint.length) {
[integrationAttributes setObject:locationHint forKey:locationHintIntegrationAttributeKey];
Expand Down