Crash + (UIImage *)sd_imageWithData:(NSData *)data; when downloading corrupted image

[domasn]

Hi,

There is a guaranteed crash in UIImage+MultiFormat.m line 33 if data is of currupted image. Probably has something to do with data length being shorter than expected. And it's a C class crash, so you can't catch it with @try {} @catch {}

Example of a crash causing image:

Crash log:

Hardware Model:      iPhone 6 (iPhone7,2)
Process:         AppName [1281]
Path:            /private/var/mobile/Containers/Bundle/Application/3A24EAC5-C813-4B05-9FD7-13D2692AF1C5/AppName.app/AppName
Identifier:      com.AppName.app
Code Type:       arm64
Parent Process:  launchd [1]

Date/Time:       2015-03-24 09:01:14 +0000
Launch Time:     2015-03-24 09:01:14 +0000
OS Version:      iOS 8.2 (12D508)

Exception Type:  SIGSEGV
Crashed Thread:  14

Application Specific Information:
*** Terminating app due to uncaught exception 'SIGSEGV', reason: ''

Thread 0:
0   libsystem_kernel.dylib        0x193928e0c _mach_msg_trap + 3596
1   CoreFoundation                0x18218e218 ___CFRunLoopServiceMachPort + 909848
2   CoreFoundation                0x18218c16c ___CFRunLoopRun + 901484
3   CoreFoundation                0x1820b91f4 _CFRunLoopRunSpecific + 37364
4   GraphicsServices              0x18b4db6fc _GSEventRunModal + 46844
5   UIKit                         0x186a4a10c _UIApplicationMain + 483596
6   AppName                         0x1000ba57c main (main.m:15)
7   libdyld.dylib                 0x19382aa08 _start + 10760

Thread 1:
0   libsystem_kernel.dylib        0x193928c24 _kevent64 + 3108
1   libdispatch.dylib             0x1937ff99c __dispatch_source_invoke + 14748

Thread 2:
0   libsystem_kernel.dylib        0x193943c78 ___workq_kernreturn + 113784
1   libsystem_pthread.dylib       0x1939dcef0 _start_wqthread + 3824

Thread 3:
0   libsystem_kernel.dylib        0x193943c78 ___workq_kernreturn + 113784
1   libsystem_pthread.dylib       0x1939dcef0 _start_wqthread + 3824

Thread 4:
0   libsystem_kernel.dylib        0x193928e0c _mach_msg_trap + 3596
1   libdispatch.dylib             0x19380e5f0 __dispatch_mach_msg_send + 75248
2   libdispatch.dylib             0x193800e68 _dispatch_mach_send + 20072
3   libxpc.dylib                  0x193a033d8 _xpc_connection_send_message_with_reply + 13272
4   Foundation                    0x182fdd634 [NSXPCConnection _sendInvocation:proxyNumber:remoteInterface:withErrorHandler:timeout:userInfo:] + 22068
5   CoreFoundation                0x1821da1c4 ____forwarding___ + 1221060
6   CoreFoundation                0x1820dec4c ___forwarding_prep_0___ + 191564
7   CFNetwork                     0x181bd0ad4 [NSURLStorage_CacheClient cachedResponseForKey:handler:] + 740052
8   CFNetwork                     0x181b93044 __ZN12__CFURLCache24calloutForAsyncDiskCacheEPK10__CFStringPK13_CFURLRequestPK12NSURLSessionU13block_pointerFvPK20_CFCachedURLResponseE + 487492
9   CFNetwork                     0x181b90b54 __ZN12__CFURLCache43CopyResponseForRequestWithCompletionHandlerEPK13_CFURLRequestbPK12NSURLSessionU13block_pointerFvPK20_CFCachedURLResponseE + 478036
10  CFNetwork                     0x181c1d834 __ZN19URLConnectionLoader22_loaderEvent_StartLoadEPK16NSURLSessionTask + 1054772
11  CFNetwork                     0x181c12af8 ____ZN19URLConnectionClient37_internalEvent_WillSendRequestPartTwoEPK12NSURLRequesth_block_invoke + 1010424
12  CFNetwork                     0x181c19cb8 ____ZN20ClassicURLConnection15withLoaderAsyncEU13block_pointerFvP15LoaderInterfaceE_block_invoke + 1039544
13  CFNetwork                     0x181c11bac ____ZNK25URLConnectionInstanceData18withWorkQueueAsyncEU13block_pointerFvvE_block_invoke + 1006508
14  libdispatch.dylib             0x1937fd994 __dispatch_call_block_and_release + 6548
15  libdispatch.dylib             0x1937fd954 __dispatch_client_callout + 6484
16  libdispatch.dylib             0x1938080a4 __dispatch_queue_drain + 49316
17  libdispatch.dylib             0x193800a5c __dispatch_queue_invoke + 19036
18  libdispatch.dylib             0x19380a318 __dispatch_root_queue_drain + 58136
19  libdispatch.dylib             0x19380bc4c __dispatch_worker_thread3 + 64588
20  libsystem_pthread.dylib       0x1939dd22c __pthread_wqthread + 4652
21  libsystem_pthread.dylib       0x1939dcef0 _start_wqthread + 3824

Thread 5:
0   libsystem_kernel.dylib        0x193928f08 _syscall_thread_switch + 3848
1   CFNetwork                     0x181b373c4 __ZN17MultiplexerSource7performEv + 111556
2   CFNetwork                     0x181b372f4 __ZN17MultiplexerSource8_performEPv + 111348
3   CoreFoundation                0x18218ed34 ___CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 912692
4   CoreFoundation                0x18218dfd8 ___CFRunLoopDoSources0 + 909272
5   CoreFoundation                0x18218c088 ___CFRunLoopRun + 901256
6   CoreFoundation                0x1820b91f4 _CFRunLoopRunSpecific + 37364
7   CFNetwork                     0x181bba2a4 [NSURLConnection(Loader) _resourceLoadLoop:] + 647844
8   Foundation                    0x1830ce308 ___NSThread__main__ + 1008392
9   libsystem_pthread.dylib       0x1939dfdc8 __pthread_body + 15816
10  libsystem_pthread.dylib       0x1939dfd24 __pthread_body + 15652
11  libsystem_pthread.dylib       0x1939dcef8 _thread_start + 3832

Thread 6:
0   libsystem_kernel.dylib        0x193928e0c _mach_msg_trap + 3596
1   CoreFoundation                0x18218e218 ___CFRunLoopServiceMachPort + 909848
2   CoreFoundation                0x18218c16c ___CFRunLoopRun + 901484
3   CoreFoundation                0x1820b91f4 _CFRunLoopRunSpecific + 37364
4   CoreFoundation                0x18210b370 _CFRunLoopRun + 373616
5   CoreMotion                    0x182abbe14 0x182a74000 + 294420
6   libsystem_pthread.dylib       0x1939dfdc8 __pthread_body + 15816
7   libsystem_pthread.dylib       0x1939dfd24 __pthread_body + 15652
8   libsystem_pthread.dylib       0x1939dcef8 _thread_start + 3832

Thread 7:
0   libsystem_kernel.dylib        0x193943498 _select$DARWIN_EXTSN + 111768
1   libsystem_pthread.dylib       0x1939dfdc8 __pthread_body + 15816
2   libsystem_pthread.dylib       0x1939dfd24 __pthread_body + 15652
3   libsystem_pthread.dylib       0x1939dcef8 _thread_start + 3832

Thread 8:
0   libsystem_kernel.dylib        0x193928e0c _mach_msg_trap + 3596
1   CoreFoundation                0x18218e218 ___CFRunLoopServiceMachPort + 909848
2   CoreFoundation                0x18218c16c ___CFRunLoopRun + 901484
3   CoreFoundation                0x1820b91f4 _CFRunLoopRunSpecific + 37364
4   WebCore                       0x1902f0620 __ZL12RunWebThreadPv + 722464
5   libsystem_pthread.dylib       0x1939dfdc8 __pthread_body + 15816
6   libsystem_pthread.dylib       0x1939dfd24 __pthread_body + 15652
7   libsystem_pthread.dylib       0x1939dcef8 _thread_start + 3832

Thread 9:
0   libsystem_kernel.dylib        0x193943078 ___psynch_cvwait + 110712
1   libc++.1.dylib                0x192928cb0 __ZNSt3__118condition_variable4waitERNS_11unique_lockINS_5mutexEEE + 36016
2   JavaScriptCore                0x18368958c __ZN3JSC14BlockAllocator22blockFreeingThreadMainEv + 103820
3   JavaScriptCore                0x183684b10 __ZN3WTFL19wtfThreadEntryPointEPv + 84752
4   libsystem_pthread.dylib       0x1939dfdc8 __pthread_body + 15816
5   libsystem_pthread.dylib       0x1939dfd24 __pthread_body + 15652
6   libsystem_pthread.dylib       0x1939dcef8 _thread_start + 3832

Thread 10:
0   libsystem_kernel.dylib        0x193943078 ___psynch_cvwait + 110712
1   libc++.1.dylib                0x192928cb0 __ZNSt3__118condition_variable4waitERNS_11unique_lockINS_5mutexEEE + 36016
2   JavaScriptCore                0x18393284c __ZN3JSC8GCThread16waitForNextPhaseEv + 2893900
3   JavaScriptCore                0x1839328f0 __ZN3JSC8GCThread12gcThreadMainEv + 2894064
4   JavaScriptCore                0x183684b10 __ZN3WTFL19wtfThreadEntryPointEPv + 84752
5   libsystem_pthread.dylib       0x1939dfdc8 __pthread_body + 15816
6   libsystem_pthread.dylib       0x1939dfd24 __pthread_body + 15652
7   libsystem_pthread.dylib       0x1939dcef8 _thread_start + 3832

Thread 11:
0   libsystem_kernel.dylib        0x193928e0c _mach_msg_trap + 3596
1   CoreFoundation                0x18218e218 ___CFRunLoopServiceMachPort + 909848
2   CoreFoundation                0x18218c16c ___CFRunLoopRun + 901484
3   CoreFoundation                0x1820b91f4 _CFRunLoopRunSpecific + 37364
4   WebCore                       0x19032445c __ZN7WebCoreL15runLoaderThreadEPv + 935004
5   JavaScriptCore                0x183684b10 __ZN3WTFL19wtfThreadEntryPointEPv + 84752
6   libsystem_pthread.dylib       0x1939dfdc8 __pthread_body + 15816
7   libsystem_pthread.dylib       0x1939dfd24 __pthread_body + 15652
8   libsystem_pthread.dylib       0x1939dcef8 _thread_start + 3832

Thread 12:
0   libsystem_kernel.dylib        0x193943c78 ___workq_kernreturn + 113784
1   libsystem_pthread.dylib       0x1939dcef0 _start_wqthread + 3824

Thread 13:
0   libsystem_kernel.dylib        0x193943c78 ___workq_kernreturn + 113784
1   libsystem_pthread.dylib       0x1939dcef0 _start_wqthread + 3824

Thread 14 Crashed:
0   libobjc.A.dylib               0x1931bfbd0 _objc_msgSend + 113616
1   AppName                         0x100274c94 NRMA__ptrParamHandler (NRMAMethodProfiler.m:750)
2   UIKit                         0x186b2cd64 [UIImage imageWithData:] + 1412452
3   AppName                         0x100274c68 NRMA__ptrParamHandler (NRMAMethodProfiler.m:743)
4   AppName                         0x1002038a0 [SGImageCacheTask fetchRemoteImage]_block_invoke_2] (SGImageCacheTask.m:77)
5   libdispatch.dylib             0x1937fd994 __dispatch_call_block_and_release + 6548
6   libdispatch.dylib             0x1937fd954 __dispatch_client_callout + 6484
7   libdispatch.dylib             0x19380a780 __dispatch_root_queue_drain + 59264
8   libdispatch.dylib             0x19380bc4c __dispatch_worker_thread3 + 64588
9   libsystem_pthread.dylib       0x1939dd22c __pthread_wqthread + 4652
10  libsystem_pthread.dylib       0x1939dcef0 _start_wqthread + 3824

Thread 15:
0   libsystem_kernel.dylib        0x193928e0c _mach_msg_trap + 3596
1   CoreFoundation                0x18218e218 ___CFRunLoopServiceMachPort + 909848
2   CoreFoundation                0x18218c16c ___CFRunLoopRun + 901484
3   CoreFoundation                0x1820b91f4 _CFRunLoopRunSpecific + 37364
4   Foundation                    0x182fe60b8 [NSRunLoop(NSRunLoop) runMode:beforeDate:] + 57528
5   Foundation                    0x1830405d8 [NSRunLoop(NSRunLoop) run] + 427480
6   AppName                         0x100155020 [AFURLConnectionOperation networkRequestThreadEntryPoint:] (AFURLConnectionOperation.m:170)
7   Foundation                    0x1830ce308 ___NSThread__main__ + 1008392
8   libsystem_pthread.dylib       0x1939dfdc8 __pthread_body + 15816
9   libsystem_pthread.dylib       0x1939dfd24 __pthread_body + 15652
10  libsystem_pthread.dylib       0x1939dcef8 _thread_start + 3832

Thread 14 crashed with arm64 Thread state:
    cpsr: 0x20000000    fp: 0x106293d90     lr: 0x100274c94     pc: 0x1931bfbd0 
    sp: 0x106293d60     x0: 0x174296bc0     x1: 0x18f592778     x10: 0x1004bc800
    x11: 0x5d0a5a       x12: 0xe512eb7a0301    x13: 0xbadd25cc35d7bead    x14: 0x66       
    x15: 0x170627a60    x16: 0x1931bfbc0    x17: 0x1931c66b8    x18: 0          
    x19: 0x174296bc0    x2: 0x1             x20: 0x1871c64c7    x21: 0          
    x22: 0x100383298    x23: 0              x24: 0x197976078    x25: 0x1062940e0
    x26: 0x1062940e0    x27: 0              x28: 0x197976080    x3: 0           
    x4: 0x17437ac00     x5: 0x18            x6: 0               x7: 0           
    x8: 0x10041f000     x9: 0x35d7bea8 

[cherpake]

+1

[domasn]

You can reproduce it with image from this url:
http://images3.booztx.com/mango/400x523/man41033663_black_99_11_copy.jpg

[mythodeia]

@mpdomas i tried your url in example from this library and got no crash.
I used both the simulator and an iPhone6Plus. Are you using the latest build ?

[domasn]

@mythodeia you're right. This image works just fine... I think it could have fixed itself when making a copy (notice the "_copy"). I'll try to reproduce a new one tomorrow and post it's url.

[domasn]

@mythodeia we've got one:
http://images3.booztx.com/d-xel/1300x1700/dxe4603370_black.jpg

[mythodeia]

i do not get a crash. with further inspection i get this:

Error Domain=SDWebImageErrorDomain Code=0 "Downloaded image has 0 pixels" UserInfo=0x7f8123f4ce70 {NSLocalizedDescription=Downloaded image has 0 pixels}

but still no crash.
Are you using the latest build from this library?

[domasn]

We were using 3.7.1. Seems that 3.7.2 fixed it.

[bpoplauschi]

great