iOS handling crash EXC_CRASH (SIGSEGV) with source code - ios

Question

I have received the following error from one of our clients with an exact place where the crash happen.
Error report:
Symbolize build number: 89778
2Incident Identifier: 8B5F5ADE-295C-4596-8B34-37280A38511A
3Hardware Model: iPhone13,2
4Process: Glip [73149]
5Path: /private/var/containers/Bundle/Application/D2CA9563-630A-470F-BC84-A9E6546D5B71/SomeApp.app
6Identifier: SomeApp
7Version: 89778 (21.2.35)
8AppStoreTools: 12E506
9AppVariant: 1:iPhone13,2:14
10Code Type: ARM-64 (Native)
11Role: unknown
12Parent Process: launchd [1]
13Coalition: com.glip.mobile [7033]
14
15
16Date/Time: 2021-07-06 18:29:00.1537 -0700
17Launch Time: 2021-07-06 18:28:56.2301 -0700
18OS Version: iPhone OS 14.6 (18F72)
19Release Type: User
20Baseband Version: 1.71.01
21Report Version: 104
22
23Exception Type: EXC_CRASH (SIGSEGV)
24Exception Codes: 0x0000000000000000, 0x0000000000000000
25Exception Note: EXC_CORPSE_NOTIFY
26Termination Signal: Segmentation fault: 11
27Termination Reason: Namespace SIGNAL, Code 0xb
28Terminating Process: Glip [73149]
29Triggered by Thread: 0
30
31Thread 0 name:
32Thread 0 Crashed:
330 CoreFoundation 0x000000018ed62ea4 __CFStringChangeSizeMultiple + 148 (CFString.c:1032)
341 CoreFoundation 0x000000018ed5d874 __CFStringAppendBytes + 708 (CFString.c:1149)
352 CoreFoundation 0x000000018ed4d800 __CFStringAppendFormatCore + 9220 (CFString.c:8375)
363 CoreFoundation 0x000000018ed619fc _CFStringAppendFormatAndArgumentsAux2 + 68 (CFString.c:7556)
374 CoreFoundation 0x000000018ec8af58 -[__NSCFString appendFormat:] + 120 (CFObject.m:462)
385 Pendo 0x0000000114173794 -[NSString(IIOStringUtils) pnd_toHexString:length:] + 116
396 Pendo 0x00000001141733cc -[NSString(IIOStringUtils) pnd_SHA256] + 112
The code responsible for the crash is the following:
//my stack trace is get called from this method (don't think its matter in that case)
- (nonnull NSString *)pnd_SHA1 {
unsigned int outputLength = CC_SHA1_DIGEST_LENGTH;
unsigned char output[outputLength];
CC_SHA1(self.UTF8String, [self pnd_UTF8Length], output);
return [NSString pnd_toHexString:output length:outputLength];
}
- (NSString *)pnd_SHA256 {
unsigned int outputLength = CC_SHA256_DIGEST_LENGTH;
unsigned char output[outputLength];
CC_SHA256(self.UTF8String, [self pnd_UTF8Length], output);
return [self pnd_toHexString:output length:outputLength];
}
- (NSString*)pnd_toHexString:(unsigned char*) data length:(unsigned int)length {
NSMutableString* hash = [NSMutableString stringWithCapacity:length * 2];
for (unsigned int i = 0; i < length; i++) {
[hash appendFormat:#"%02x", data[i]];
data[i] = 0;
}
return [hash copy];
}
From quick look I immediately blamed the following line:
[hash appendFormat:#"%02x", data[i]];
So I reproduced the crash by:[hash appendFormat:nil];
And the local report I got: (which is similar BUT not exact)
Process: MyApp [45754]
Path: /Users/USER/Library/Developer/CoreSimulator/Devices/EAEA42C2-3B8F-48EF-B1D3-BEA68FE046A0/data/Containers/Bundle/Application/DE83DA67-70A9-4ECF-92B9-526137C6E4B3/MyApp
Identifier: PendoDevelopmentApp
Version: 1.0 (1)
Code Type: X86-64 (Native)
Parent Process: launchd_sim [24742]
Responsible: SimulatorTrampoline [957]
User ID: 502
Date/Time: 2021-07-21 14:42:56.804 +0300
OS Version: Mac OS X 10.15.7 (19H1217)
Report Version: 12
Bridge OS Version: 5.4 (18P4663)
Anonymous UUID: 74B25560-EFCE-769F-F0B4-E4DD4C6B09A4
Sleep/Wake UUID: F52FC80E-F86E-4813-B352-D0A7B5FF87B2
Time Awake Since Boot: 120000 seconds
Time Since Wake: 6700 seconds
System Integrity Protection: enabled
Crashed Thread: 0 Dispatch queue: com.apple.main-thread
Exception Type: EXC_BAD_ACCESS (SIGSEGV)
Exception Codes: KERN_INVALID_ADDRESS at 0x0000000000000000
Exception Note: EXC_CORPSE_NOTIFY
Termination Signal: Segmentation fault: 11
Termination Reason: Namespace SIGNAL, Code 0xb
Terminating Process: exc handler [45754]
VM Regions Near 0:
-->
__TEXT 000000010f038000-000000010f0bc000 [ 528K] r-x/r-x SM=COW /Users/USER/Library/Developer/CoreSimulator/Devices/EAEA42C2-3B8F-48EF-B1D3-BEA68FE046A0/data/Containers/Bundle/Application/DE83DA67-70A9-4ECF-92B9-526137C6E4B3/MyApp
Application Specific Information:
CoreSimulator 732.18.6 - Device: iPhone 11 Pro Max (EAEA42C2-3B8F-48EF-B1D3-BEA68FE046A0) - Runtime: iOS 13.0 (17A577) - DeviceType: iPhone 11 Pro Max
Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0 com.apple.CoreFoundation 0x00007fff23b1df08 __CFStringAppendFormatCore + 536
1 com.apple.CoreFoundation 0x00007fff23b395cc _CFStringAppendFormatAndArgumentsAux2 + 60
2 com.apple.CoreFoundation 0x00007fff23accba8 -[__NSCFString appendFormat:] + 184
3 io.pendo.PendoSDKFramework 0x000000010f35061d -[NSString(IIOStringUtils) pnd_toHexString:length:] + 109 (NSString+IIOStringUtils.m:111)
4 io.pendo.PendoSDKFramework 0x000000010f35010f -[NSString(IIOStringUtils) pnd_SHA256] + 175 (NSString+IIOStringUtils.m:57)
and fixed the code as follows:
+ (NSString*)pnd_toHexString:(unsigned char*)data length:(unsigned int)length {
if (data == nil || data == NULL) {
IIOCriticalLog(#"hash diget is nil");
return nil;
}
NSMutableString* hash = [NSMutableString stringWithCapacity:length * 2];
for (unsigned int i = 0; i < length; i++) {
NSString *str = [NSString stringWithFormat:#"%02x",data[i]];
if (str == nil) {
IIOCriticalLog(#"hash diget was corrupted");
return nil;
}
[hash appendString:str];
data[i] = 0;
}
return [hash copy];
}
The problem that I am still not 100% sure how it could happen for only this specific client as for how the appendString could get a nil.
Maybe somebody had a similar issue.