Skip to content

Fatal crash (may be caused by a bug in toml++) #12

@stackotter

Description

@stackotter

Hi @LebJe,

I have found a reproducible fatal crash in TOMLKit. Here's the minimum code that I have been able to reproduce the crash with:

import Foundation
import TOMLKit

let string = "[[apps.test]]"

struct Child: Codable {
    var value: String // if Child is an empty struct it doesn't crash
}

struct Parent: Codable {
    var apps: [String: Child] // if this is just `[String: String]` it doesn't crash
}

try? TOMLDecoder().decode(Parent.self, from: string)

The realworld use case I have that runs into this fatal crash (with incorrect TOML input) is decoding this Configuration struct from this string:

[[apps.HelloWorld]]
product = "HelloWorld"
version = "0.1.0"

The TOML is invalid because it's not meant to have double square brackets, however fatal crashes shouldn't occur even with invalid input.

I have done a bit of poking around and I think I have found the issue. TOMLKit thinks that the array at coding path apps.HelloWorld is both a table and an array (these values are from inside TOMLTable.keys):

(lldb) po tomlValue.array
▿ Optional<TOMLArray>
  ▿ some : [ { minimum_macos_version = '11', product = 'HelloWorld', version = '0.1.0' } ]

(lldb) po tomlValue.table
▿ Optional<TOMLTable>
  ▿ some : [ { minimum_macos_version = '11', product = 'HelloWorld', version = '0.1.0' } ]

For some reason casting the value to both an array and a table succeeds.

I have found a way to fix the crash: checking the type of the node before attempting to cast it so that these invalid type casts can't occur anymore.

I will submit a PR soon with the required changes (once I have run the tests).

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions