From d9689b90a4023efaa8c35824d63e8fe0c692b9fb Mon Sep 17 00:00:00 2001 From: Andrei Shikov Date: Wed, 20 Oct 2021 08:26:43 -0700 Subject: [PATCH] Fix memory corruption issue in SurfaceHandler Summary: SurfaceHandlerBinding uses string from JVM memory when initializing, which is released before it is used. If JVM manages to collect this memory before instance init, it can lead to use-after-free. Changelog: [Internal] - fix memory corruption in cxx binding of surface handler Reviewed By: mdvacca Differential Revision: D31794515 fbshipit-source-id: 3944ebd065f42a516f036096d07c0126a43c912f --- .../com/facebook/react/fabric/jni/SurfaceHandlerBinding.cpp | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/ReactAndroid/src/main/java/com/facebook/react/fabric/jni/SurfaceHandlerBinding.cpp b/ReactAndroid/src/main/java/com/facebook/react/fabric/jni/SurfaceHandlerBinding.cpp index 0df81d2a899..bf16b199922 100644 --- a/ReactAndroid/src/main/java/com/facebook/react/fabric/jni/SurfaceHandlerBinding.cpp +++ b/ReactAndroid/src/main/java/com/facebook/react/fabric/jni/SurfaceHandlerBinding.cpp @@ -58,11 +58,13 @@ SurfaceHandlerBinding::initHybrid( jint surfaceId, jni::alias_ref moduleName) { auto env = jni::Environment::current(); + const char *moduleNameValue = env->GetStringUTFChars(moduleName.get(), JNI_FALSE); + auto instance = makeCxxInstance(surfaceId, moduleNameValue); env->ReleaseStringUTFChars(moduleName.get(), moduleNameValue); - return makeCxxInstance(surfaceId, moduleNameValue); + return instance; } void SurfaceHandlerBinding::setLayoutConstraints(