Skip to content

fix(ios): pass log message as NSLog argument, not format string#108

Open
bkuhl wants to merge 1 commit intoNativePHP:mainfrom
bkuhl:fix/ios-nslog-format-string-crash
Open

fix(ios): pass log message as NSLog argument, not format string#108
bkuhl wants to merge 1 commit intoNativePHP:mainfrom
bkuhl:fix/ios-nslog-format-string-crash

Conversation

@bkuhl
Copy link
Copy Markdown
Contributor

@bkuhl bkuhl commented Apr 28, 2026

Problem

PHPSchemeHandler.getResponse(request:completion:) interpolates the request URI directly into NSLog's first argument:

NSLog("[NativePHP] [\(mode)] --> \(request.method) \(request.uri)")

NSLog's first argument is a printf-style format string. Swift string interpolation embeds the URI into that format string verbatim, so any % in the URI is parsed as a format specifier. When the URI contains %XX percent-encoded sequences (the normal case for any path with reserved characters or rawurlencoded data), NSLog reads va_args that don't exist and dereferences garbage memory.

Result: EXC_BAD_ACCESS (SIGSEGV) on the com.nativephp.persistent-php queue. Reproducible whenever a request's URI contains %. Stack trace top frames:

__CFStringAppendFormatCore
_CFStringCreateWithFormatAndArgumentsReturningMetadata
_os_log_with_args_impl
_NSLogv
specialized withVaList<A>(_:_:)
closure #1 in PHPSchemeHandler.getResponse(request:completion:)  PHPSchemeHandler.swift:595

Fix

Use NSLog's two-argument form so the message is an argument to %@, not part of the format string. Two-line change to lines 595 and 609:

-NSLog("[NativePHP] [\(mode)] --> \(request.method) \(request.uri)")
+NSLog("%@", "[NativePHP] [\(mode)] --> \(request.method) \(request.uri)")
-NSLog("[NativePHP] [\(mode)] <-- \(statusLine) (\(String(format: "%.1f", elapsed))ms)")
+NSLog("%@", "[NativePHP] [\(mode)] <-- \(statusLine) (\(String(format: "%.1f", elapsed))ms)")

Identical log output, no crash. Same pattern any printf-style API expects: format string is a constant; data goes through arguments.

Test plan

  • Reproduced crash on simulator with a URI containing %XX sequences (real-world rawurlencode'd token)
  • After fix: same URI, no crash, identical log output
  • URIs without % (the only ones that didn't crash before) still log correctly

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant