{"action":"opened","issue":{"url":"https://api.github.com/repos/Microsoft/WinObjC/issues/1412","repository_url":"https://api.github.com/repos/Microsoft/WinObjC","labels_url":"https://api.github.com/repos/Microsoft/WinObjC/issues/1412/labels{/name}","comments_url":"https://api.github.com/repos/Microsoft/WinObjC/issues/1412/comments","events_url":"https://api.github.com/repos/Microsoft/WinObjC/issues/1412/events","html_url":"https://github.com/Microsoft/WinObjC/issues/1412","id":190243959,"number":1412,"title":"CGImages loaded from container data (JPEG, PNG, TIFF) can use-after-free their buffers.","user":{"login":"DHowett-MSFT","id":14316954,"avatar_url":"https://avatars.githubusercontent.com/u/14316954?v=3","gravatar_id":"","url":"https://api.github.com/users/DHowett-MSFT","html_url":"https://github.com/DHowett-MSFT","followers_url":"https://api.github.com/users/DHowett-MSFT/followers","following_url":"https://api.github.com/users/DHowett-MSFT/following{/other_user}","gists_url":"https://api.github.com/users/DHowett-MSFT/gists{/gist_id}","starred_url":"https://api.github.com/users/DHowett-MSFT/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/DHowett-MSFT/subscriptions","organizations_url":"https://api.github.com/users/DHowett-MSFT/orgs","repos_url":"https://api.github.com/users/DHowett-MSFT/repos","events_url":"https://api.github.com/users/DHowett-MSFT/events{/privacy}","received_events_url":"https://api.github.com/users/DHowett-MSFT/received_events","type":"User","site_admin":false},"labels":[{"id":400586057,"url":"https://api.github.com/repos/Microsoft/WinObjC/labels/Area-Foundation","name":"Area-Foundation","color":"f9d0c4","default":false},{"id":228130723,"url":"https://api.github.com/repos/Microsoft/WinObjC/labels/Bug","name":"Bug","color":"fc2929","default":false},{"id":460463549,"url":"https://api.github.com/repos/Microsoft/WinObjC/labels/SubArea-CoreGraphics","name":"SubArea-CoreGraphics","color":"006b75","default":false}],"state":"open","locked":false,"assignee":{"login":"msft-Jeyaram","id":18413092,"avatar_url":"https://avatars.githubusercontent.com/u/18413092?v=3","gravatar_id":"","url":"https://api.github.com/users/msft-Jeyaram","html_url":"https://github.com/msft-Jeyaram","followers_url":"https://api.github.com/users/msft-Jeyaram/followers","following_url":"https://api.github.com/users/msft-Jeyaram/following{/other_user}","gists_url":"https://api.github.com/users/msft-Jeyaram/gists{/gist_id}","starred_url":"https://api.github.com/users/msft-Jeyaram/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/msft-Jeyaram/subscriptions","organizations_url":"https://api.github.com/users/msft-Jeyaram/orgs","repos_url":"https://api.github.com/users/msft-Jeyaram/repos","events_url":"https://api.github.com/users/msft-Jeyaram/events{/privacy}","received_events_url":"https://api.github.com/users/msft-Jeyaram/received_events","type":"User","site_admin":false},"assignees":[{"login":"msft-Jeyaram","id":18413092,"avatar_url":"https://avatars.githubusercontent.com/u/18413092?v=3","gravatar_id":"","url":"https://api.github.com/users/msft-Jeyaram","html_url":"https://github.com/msft-Jeyaram","followers_url":"https://api.github.com/users/msft-Jeyaram/followers","following_url":"https://api.github.com/users/msft-Jeyaram/following{/other_user}","gists_url":"https://api.github.com/users/msft-Jeyaram/gists{/gist_id}","starred_url":"https://api.github.com/users/msft-Jeyaram/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/msft-Jeyaram/subscriptions","organizations_url":"https://api.github.com/users/msft-Jeyaram/orgs","repos_url":"https://api.github.com/users/msft-Jeyaram/repos","events_url":"https://api.github.com/users/msft-Jeyaram/events{/privacy}","received_events_url":"https://api.github.com/users/msft-Jeyaram/received_events","type":"User","site_admin":false}],"milestone":null,"comments":0,"created_at":"2016-11-18T06:13:32Z","updated_at":"2016-11-18T06:13:32Z","closed_at":null,"body":"In CGImage [here](https://github.com/Microsoft/WinObjC/blob/CGD2D/Frameworks/CoreGraphics/CGImage.mm#L493), we specify `OnDemand` caching for images loaded from WIC frame decoders.\r\n\r\nUnfortunately, if you do this:\r\n\r\n```c\r\nCFDataRef data = CFDataCreate(...);\r\nCGImageRef image = CGImageCreateWithDataProvider(CGDataProviderCreateWithCFData(data), ...);\r\nCFRelease(data);\r\nCGImageDoAnythingAtAll(image);\r\n```\r\n\r\nLine 4 will cause CGImage through WIC to read the buffer backing the CGData destroyed on line 3.\r\n\r\n*Interim solution*: Switch to `OnLoad.`\r\n\r\n*Suggested future solution*: Implement an IWICStream that is backed by a CGDataProvider."}}
{"actor":{"display_login":"DHowett-MSFT"}}