mirror of
https://github.com/jamesstringer90/appsandbox.git
synced 2026-10-22 02:52:49 -05:00
- C8 StageEntry stored ARC __strong NSString members in an NSValue (raw byte
copy, no retain), so ARC over-released them each loop iteration ->
double-free/UAF in the privileged stage path; mark __unsafe_unretained
(the source strings outlive the command via the outer autorelease pool).
- L10 resumeDataFromSidecarAt: `raw.length < 8 + n` overflowed for n near
UINT64_MAX, bypassing the guard and throwing NSRangeException; compare
with subtraction (`n > raw.length - 8`).