[Bug]: [OneSignalRequest urlRequest] Crash

[danhalliday]

What happened?

iOS app crashed in production with a stack trace showing OneSignal frames.

Steps to reproduce?

No idea. This is a remote crash report from Crashlytics.

What did you expect to happen?

The library should not cause a crash, regardless of what I may be doing wrong in using it.

OneSignal iOS SDK version

5.1.0

iOS version

11 or below

Specific iOS version

* 17.2.1
* 17.1.0

Relevant log output

Crashed: com.apple.root.default-qos
0  libsystem_kernel.dylib         0x9fbc __pthread_kill + 8
1  libsystem_pthread.dylib        0x5680 pthread_kill + 268
2  libsystem_c.dylib              0x75b90 abort + 180
3  libsystem_malloc.dylib         0x26200 malloc_vreport + 908
4  libsystem_malloc.dylib         0x264a8 malloc_zone_error + 104
5  libsystem_malloc.dylib         0x1dac8 nanov2_guard_corruption_detected + 44
6  libsystem_malloc.dylib         0x7e78 nanov2_find_block_and_allocate + 402
7  CoreFoundation                 0x26a8 _CFRuntimeCreateInstance + 448
8  CoreFoundation                 0x2134 __CFStringCreateImmutableFunnel3 + 1940
9  CoreFoundation                 0x9d2d0 _CFURLComponentsCreateWithStringInternal + 1872
10 Foundation                     0x650d8 -[__NSConcreteURLComponents initWithString:encodingInvalidCharacters:] + 116
11 Foundation                     0x64d88 -[NSURL(NSURL) initWithString:relativeToURL:encodingInvalidCharacters:] + 284
12 Foundation                     0x64c48 +[NSURL(NSURL) URLWithString:relativeToURL:] + 44
13 OneSignalCore                  0x6cac -[OneSignalRequest urlRequest] + 128
14 OneSignalCore                  0xd828 -[OneSignalClient prettyPrintDebugStatementWithRequest:] + 256
15 OneSignalCore                  0xd410 -[OneSignalClient validRequest:] + 56
16 OneSignalCore                  0xc814 -[OneSignalClient executeRequest:onSuccess:onFailure:] + 460
17 OneSignalUser                  0x1bc78 block_destroy_helper.32 + 21760
18 OneSignalUser                  0x1c9cc block_destroy_helper.32 + 25172
19 OneSignalOSCore                0x8e90 __swift_instantiateConcreteTypeFromMangledName + 4288
20 OneSignalOSCore                0x8190 __swift_instantiateConcreteTypeFromMangledName + 960
21 OneSignalOSCore                0x81f4 __swift_instantiateConcreteTypeFromMangledName + 1060
22 libdispatch.dylib              0x4300 _dispatch_client_callout + 20
23 libdispatch.dylib              0x77b8 _dispatch_continuation_pop + 600
24 libdispatch.dylib              0x1b5c0 _dispatch_source_latch_and_call + 420
25 libdispatch.dylib              0x1a190 _dispatch_source_invoke + 832
26 libdispatch.dylib              0x72a4 _dispatch_queue_override_invoke + 504
27 libdispatch.dylib              0x15be4 _dispatch_root_queue_drain + 392
28 libdispatch.dylib              0x163ec _dispatch_worker_thread2 + 156
29 libsystem_pthread.dylib        0x1928 _pthread_wqthread + 228
30 libsystem_pthread.dylib        0x1a04 start_wqthread + 8

Code of Conduct

• I agree to follow this project's Code of Conduct

[nan-li]

Hi @danhalliday, thanks for reporting.

• Is this all the information from the crash log?

• Is there any information about what the error is like this:

Exception Type:  EXC_BREAKPOINT (SIGTRAP)
Exception Codes: 0x0000000000000001, 0x0000000102afb3d0

• How many users / what percent of users have been affected by this crash?
• I have some clues what could be happening here, but to confirm, do you ever call login with an external_id that could contain potentially problematic characters?
  • Such as special characters like @ # " ' [ ] / \ . , ;, or non-English characters, etc?
  • What type of characters are used in your external_id?

[danhalliday]

@nan-li All our user IDs are UUIDs, with the usual format (eg. 3a0e68e4-7cc3-4602-ac61-131d00222d01). This doesn't seem to be something that would cause an issue with URL encoding or other serialisations.

Given the nanov2_guard_corruption_detected stack frame surely this is a thread safety issue?

[nan-li]

Hi @danhalliday, thanks for confirming your user IDs.

The reason it looks like URL encoding or serialization to me, from first glance is the stack trace leading up to the crash is creating an NSURL instance.

1. [OneSignalClient prettyPrintDebugStatementWithRequest:] followed by [OneSignalRequest urlRequest] leads to this line of code which is printing a debug statement.

2. Which then calls into the creation of the NSURL [NSURL(NSURL) URLWithString:relativeToURL:] in this line of code.

[algoroq]

Hi, I am getting the exact same error on iOS 17.4.1 as well.