[PLAT-7010 ] Fix strlen crash in bsg_ksmachgetThreadQueueName

[nickdowell]

Goal

Fixes a (rare) crash in bsg_ksmachgetThreadQueueName when calling strlen for a dispatch queue label.

Exception Type:        EXC_BAD_ACCESS (SIGSEGV)
Exception Codes:       EXC_I386_GPFLT

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   libsystem_c.dylib    0x111c07172 strlen + 18
1   com.bugsnag.Bugsnag  0x12075d21a bsg_ksmachgetThreadQueueName + 442 (BSG_KSMach.c:336)
2   com.bugsnag.Bugsnag  0x12074b1a7 -[BugsnagThread initWithMachThread:backtraceAddresses:backtraceLength:errorReportingThread:index:] + 231
3   com.bugsnag.Bugsnag  0x12074aa62 +[BugsnagThread allThreadsWithCurrentThreadBacktrace:] + 690 BugsnagThread.m:247)
4   com.bugsnag.Bugsnag  0x12074a6c3 +[BugsnagThread allThreads:callStackReturnAddresses:] + 51 (BugsnagThread.m:206)
5   com.bugsnag.Bugsnag  0x120721c71 -[BugsnagClient notify:handledState:block:] + 497 (BugsnagClient.m:856)
6   com.bugsnag.Bugsnag  0x120720f01 -[BugsnagClient notifyError:] + 385 (BugsnagClient.m:766)

Analysis

When a thread is being destroyed, its dispatch_queue's memory may be deallocated (and reused for something else) while bsg_ksmachgetThreadQueueName is executing, resulting in calling dispatch_queue_get_label with an invalid pointer.

Previous fixes ensured that the dispatch_queue points to readable memory, but since dispatch_queue_get_label simply returns a pointer from an offset into the struct, an invalid pointer could be returned that would cause strlen to crash.

Changeset

vm_read_overwrite is now used to safely read from the pointer returned by dispatch_queue_get_label.

Testing

A unit test case has been added that is able to reliably reproduce the crash (without the fix in place) when MallocScribble is enabled.

See https://buildkite.com/bugsnag/bugsnag-cocoa/builds/3068 for positive detection of the crash without the fix in place.

[github-actions]

Infer: No issues found 🎉

OCLint: No issues found 🎉

Bugsnag.framework binary size did not change - 1,133,880 bytes

Generated by 🚫 Danger