From c99e7392e040e939a0607f11c483695ae470d6b2 Mon Sep 17 00:00:00 2001 From: quantpoet Date: Fri, 19 Sep 2025 18:59:40 +0800 Subject: [PATCH] Fix use-after-free issues in Core Foundation object management Signed-off-by: quantpoet --- core-text/src/font_descriptor.rs | 5 ++--- core-text/src/font_manager.rs | 5 +++-- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/core-text/src/font_descriptor.rs b/core-text/src/font_descriptor.rs index 4a8c67bf0..9e6dd60cd 100644 --- a/core-text/src/font_descriptor.rs +++ b/core-text/src/font_descriptor.rs @@ -311,9 +311,8 @@ impl CTFontDescriptor { unsafe { let value = CTFontDescriptorCopyAttribute(self.0, kCTFontTraitsAttribute); assert!(!value.is_null()); - let value = CFType::wrap_under_create_rule(value); - assert!(value.instance_of::()); - CFDictionary::wrap_under_get_rule(value.as_CFTypeRef() as CFDictionaryRef) + // Use wrap_under_create_rule for the dictionary directly to maintain ownership + CFDictionary::wrap_under_create_rule(value as CFDictionaryRef) } } diff --git a/core-text/src/font_manager.rs b/core-text/src/font_manager.rs index dff0f8d0f..ef27bd90e 100644 --- a/core-text/src/font_manager.rs +++ b/core-text/src/font_manager.rs @@ -21,8 +21,9 @@ pub fn copy_available_font_family_names() -> CFArray { pub fn create_font_descriptor(buffer: &[u8]) -> Result { let cf_data = CFData::from_buffer(buffer); unsafe { - let ct_font_descriptor_ref = - CTFontManagerCreateFontDescriptorFromData(cf_data.as_concrete_TypeRef()); + // Keep cf_data alive by getting the raw pointer within the unsafe block + let data_ref = cf_data.as_concrete_TypeRef(); + let ct_font_descriptor_ref = CTFontManagerCreateFontDescriptorFromData(data_ref); if ct_font_descriptor_ref.is_null() { return Err(()); }