CGDataProvider and SIGSEGV

[richard-uk1]

It seems as though CGDataProvder::from_buffer segfaults if the buffer is empty. A reproducing test case would be something like

let buf: Arc<[u8]> = Arc::new([]);
CGDataProvider::from_buffer(buf)

I don't have a macOS box for testing, so this is based on experimentation with github CI. Apologies if I'm mistaken about this issue.

[jrmuizel]

What version of the core-graphics crate are you using?

[jrmuizel]

Also,

let buf: Arc<[u8]> = Arc::new([]);
CGDataProvider::from_buffer(buf)

gives me:

error[E0277]: the size for values of type `[u8]` cannot be known at compilation time
  --> src/main.rs:7:33
   |
7  |     CGDataProvider::from_buffer(buf);
   |                                 ^^^ doesn't have a size known at compile-time
   | 
  ::: /Users/jrmuizel/.cargo/registry/src/git.colasdn.top-1ecc6299db9ec823/core-graphics-0.22.2/src/data_provider.rs:53:24
   |
53 |     pub fn from_buffer<T: AsRef<[u8]> + Sync + Send>(buffer: Arc<T>) -> Self {
   |                        - required by this bound in `core_graphics::data_provider::CGDataProvider::from_buffer`
   |
   = help: the trait `Sized` is not implemented for `[u8]`

[jrmuizel]

A variant with a zero len Vec also crashes in ERROR_CGDataProviderCreateWithData_BufferIsNotReadable. We could potentially panic earlier.

[richard-uk1]

So the place this came up is in the piet project, whencreating image with zero width and height, and no data.

[jrmuizel]

So yeah, you only get to have a 0 length CGDataProvider if it's pointing at something dereferenceable. You could substitute at 1 length buffer in piet to work around it.

[richard-uk1]

Thanks for the advice. The worry is that you can corrupt memory with a safe method. Did you way that you didn't get a segfault: you got a panic instead?

[jrmuizel]

No, I got a segfault as well, but it's a segfault specifically designed for catching unreadable buffers and so there doesn't seem to be a danger in corrupting memory.

I'm proposing adding a panic CGDataProvider::from_buffer if the length is 0 so that we don't get the segfault at all.

[richard-uk1]

All sounds good :)

[richard-uk1]

Could you also add a + ?Sized to the constraints on T in DataProvider::from_buffer? That way you can use a Arc<[u8]>, which currently isn't possible because [u8] is unsized. I checked and the code will still be correct, but I haven't actually built it because I don't have a macos box.

^^ originally I thought I was passing an empty Arc<[u8]> but it was actually an Arc<Vec<u8>>, as you suspected.