Skip to content

[iOS] Fix potential use-after-free in a11y bridge channel handler#189637

Merged
cbracken merged 1 commit into
flutter:masterfrom
cbracken:fix-ios-a11y-uaf
Jul 17, 2026
Merged

[iOS] Fix potential use-after-free in a11y bridge channel handler#189637
cbracken merged 1 commit into
flutter:masterfrom
cbracken:fix-ios-a11y-uaf

Conversation

@cbracken

@cbracken cbracken commented Jul 17, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

AccessibilityBridge's constructor registers a message handler Obj-C block on accessibility_channel_ (the "flutter/accessibility" channel) that calls the class's HandleEvent(...) method directly:

[accessibility_channel_ setMessageHandler:^(id message, FlutterReply reply) {
  HandleEvent((NSDictionary*)message);  // Implicit this capture.
}];

This implicitly captures this as a raw C++ pointer. ARC manages the block and any captured Obj-C objects, but has no idea about the raw C++ this pointer and we do nothing to keep the AccessibilityBridge alive or to null out this when it's destroyed. If a message arrives on this channel while or after the bridge is being torn down (e.g. during engine shutdown), we'll dereference the (now garbage) dangling AccessibilityBridge*.

We fix this by capturing fml::WeakPtr<AccessibilityBridge> weak_self = GetWeakPtr() by value in the block instead, and checking it before calling HandleEvent. The weak_factory_ is already declared last in the AccessibilityBridge class member list, so it'll be invalidated first in the class destructor, so we're not at risk of using the bridge in a half torn-down state. Messages arriving anytime after the start of the destructor are now handled as a no-op.

I've added a test which captures the message handler registered on the channel, destroys the AccessibilityBridge, and invokes the captured handler to confirm it no longer touches dealloc'ed memory.

Issue: b/525528671
Related: #189630

Pre-launch Checklist

If you need help, consider asking for advice on the #hackers-new channel on Discord.

If this change needs to override an active code freeze, provide a comment explaining why. The code freeze workflow can be overridden by code reviewers. See pinned issues for any active code freezes with guidance.

Note: The Flutter team is currently trialing the use of Gemini Code Assist for GitHub. Comments from the gemini-code-assist bot should not be taken as authoritative feedback from the Flutter team. If you find its comments useful you can update your code accordingly, but if you are unsure or disagree with the feedback, please feel free to wait for a Flutter team member's review for guidance on which automated comments should be addressed.

@cbracken
cbracken requested a review from a team as a code owner July 17, 2026 01:55
@flutter-dashboard flutter-dashboard Bot added the CICD Run CI/CD label Jul 17, 2026
@github-actions github-actions Bot added platform-ios iOS applications specifically engine flutter/engine related. See also e: labels. a: accessibility Accessibility, e.g. VoiceOver or TalkBack. (aka a11y) team-ios Owned by iOS platform team labels Jul 17, 2026
gemini-code-assist[bot]
gemini-code-assist Bot reviewed Jul 17, 2026
View reviewed changes

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request addresses a potential Use-After-Free (UAF) vulnerability in AccessibilityBridge by capturing a weak pointer (fml::WeakPtr) instead of a raw pointer in the accessibility channel message handler block, and adds a unit test to verify this behavior. The review feedback suggests guarding the invocation of the captured handler in the test with a nil check to prevent potential test runner crashes if the handler is not successfully captured.

Comment thread engine/src/flutter/shell/platform/darwin/ios/framework/Source/accessibility_bridge_test.mm Outdated
@cbracken
cbracken force-pushed the fix-ios-a11y-uaf branch 2 times, most recently from cb66119 to d366da1 Compare July 17, 2026 02:13
@cbracken
cbracken requested a review from hellohuanlin July 17, 2026 02:14
@cbracken
cbracken force-pushed the fix-ios-a11y-uaf branch 6 times, most recently from f478d75 to 0f6fb4a Compare July 17, 2026 08:49
@cbracken
[iOS] Fix potential use-after-free in a11y bridge channel handler
a1f5bf3 
`AccessibilityBridge`'s constructor registers a message handler Obj-C
block on `accessibility_channel_` (the "flutter/accessibility" channel)
that calls the class's `HandleEvent(...)` method directly:

    [accessibility_channel_ setMessageHandler:^(id message, FlutterReply reply) {
      HandleEvent((NSDictionary*)message);
    }];

This implicitly captures `this` as a raw C++ pointer. ARC manages the
block and any captured Obj-C objects, but has no idea about the raw C++
`this` pointer and we do nothing to keep the `AccessibilityBridge` alive
or to null out `this` when it's destroyed. If a message arrives on this
channel while or after the bridge is being torn down (e.g. during engine
shutdown), we'll dereference the (now garbage) dangling `AccessibilityBridge*`.

We fix this by capturing `fml::WeakPtr<AccessibilityBridge> weak_self =
GetWeakPtr()` by value in the block instead, and checking it before calling
`HandleEvent`. The `weak_factory_` is already declared last in the
`AccessibilityBridge` class member list, so it'll be invalidated first
in the class destructor, so we're not at risk of using the bridge in a
half torn-down state. Messages arriving anytime after the start of the
destructor are now handled as a no-op.

I've added a test which captures the message handler registered on the
channel, destroys the `AccessibilityBridge`, and invokes the captured
handler to confirm it no longer touches dealloc'ed memory.

Issue: b/525528671
Related: flutter#189630
hellohuanlin
hellohuanlin reviewed Jul 17, 2026
View reviewed changes
Comment thread engine/src/flutter/shell/platform/darwin/ios/framework/Source/accessibility_bridge.mm
[accessibility_channel_ setMessageHandler:^(id message, FlutterReply reply) {
HandleEvent((NSDictionary*)message);
if (weak_self) {
weak_self->HandleEvent((NSDictionary*)message);

@hellohuanlin hellohuanlin Jul 17, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

One more reason to migrate to Swift - The compiler would force you to write self.HandleEvent(...), which reminds you to double check strong or weak self.

hellohuanlin
hellohuanlin approved these changes Jul 17, 2026
View reviewed changes

@hellohuanlin hellohuanlin left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

@cbracken
cbracken added this pull request to the merge queue Jul 17, 2026
Merged via the queue into flutter:master with commit 1366c55 Jul 17, 2026
15 checks passed
@cbracken
cbracken deleted the fix-ios-a11y-uaf branch July 17, 2026 23:53
@engine-flutter-autoroll engine-flutter-autoroll mentioned this pull request Jul 18, 2026
Merged
auto-submit Bot pushed a commit to flutter/packages that referenced this pull request Jul 18, 2026
@engine-flutter-autoroll
Roll Flutter from fc1ad955f164 to 8005793c3562 (40 revisions) (#12241)
1213057 
Roll Flutter from fc1ad955f164 to 8005793c3562 (40 revisions)

flutter/flutter@fc1ad95...8005793

2026-07-18 [email protected] Remove `LineContents ` experimental AA line shader that is no longer used (flutter/flutter#189619)
2026-07-18 [email protected] Roll Skia from 9468e96cc40f to ba90f98535de (8 revisions) (flutter/flutter#189680)
2026-07-17 [email protected] Roll Dart SDK from 33e4b71e984b to 666e1e2133b7 (2 revisions) (flutter/flutter#189673)
2026-07-17 [email protected] [iOS] Fix potential use-after-free in a11y bridge channel handler (flutter/flutter#189637)
2026-07-17 [email protected] Migrate dev/tools skill validation to new dart_skills_lint API (flutter/flutter#189626)
2026-07-17 [email protected] Add validation for required fields during xcodebuild (flutter/flutter#187772)
2026-07-17 [email protected] Upgrade android_hardware_smoke_test CI to run instrumented tests (flutter/flutter#189390)
2026-07-17 [email protected] Roll Dart SDK from 0867cb1897b5 to 33e4b71e984b (1 revision) (flutter/flutter#189661)
2026-07-17 [email protected] Roll Skia from 702c3e790232 to 9468e96cc40f (1 revision) (flutter/flutter#189660)
2026-07-17 [email protected] Roll Packages from 9f95026 to 4fdc766 (11 revisions) (flutter/flutter#189659)
2026-07-17 [email protected] Roll Skia from 2e4a3ae035cd to 702c3e790232 (1 revision) (flutter/flutter#189655)
2026-07-17 [email protected] [macOS] Add FlutterPluginRegistrar.valuePublished(byPlugin:) just like iOS (flutter/flutter#189614)
2026-07-17 [email protected] Roll Dart SDK from c69d138c9646 to 0867cb1897b5 (2 revisions) (flutter/flutter#189649)
2026-07-17 [email protected] Roll Skia from 4f5aca109c87 to 2e4a3ae035cd (3 revisions) (flutter/flutter#189646)
2026-07-17 [email protected] [iOS] Fix missing nil checks and improve SemanticsObject bridge API (flutter/flutter#189630)
2026-07-17 [email protected] Roll Skia from 37c5e6b26aee to 4f5aca109c87 (19 revisions) (flutter/flutter#189638)
2026-07-17 [email protected] Roll Fuchsia Linux SDK from lLFbh5kFWbUGgC9Ek... to NL8xtzr8cxr5E8r8E... (flutter/flutter#189632)
2026-07-17 [email protected] Add blendMode parameter to RawImage and RenderImage (flutter/flutter#185938)
2026-07-17 [email protected] [web] Cache WASM network requests in flutter test (flutter/flutter#189623)
2026-07-17 [email protected] android_hardware_smoke_tests: Apply semantic line breaks to readme (flutter/flutter#189613)
2026-07-16 [email protected] ci(github-actions): resolve zizmor github-env findings in composite flutter actions (flutter/flutter#189602)
2026-07-16 [email protected] Remove obsolete packages analysis flag (flutter/flutter#189525)
2026-07-16 [email protected] Roll Dart SDK from e24870ff15bc to c69d138c9646 (2 revisions) (flutter/flutter#189597)
2026-07-16 [email protected] [fuchsia][iwyu] Remove transitive include of fuchsia.input.report. (flutter/flutter#188891)
2026-07-16 [email protected] Remove unnecessary value key hack in `key.dart`  (flutter/flutter#189291)
2026-07-16 [email protected] Roll Dart SDK from 81306a2ed317 to e24870ff15bc (1 revision) (flutter/flutter#189569)
2026-07-16 [email protected] [Impeller] Fix atlas growth test (flutter/flutter#189533)
2026-07-16 [email protected] Roll Dart SDK from d402ff7c9c84 to 81306a2ed317 (4 revisions) (flutter/flutter#189558)
2026-07-16 [email protected] Move shared darwin plugin tests into own builder (flutter/flutter#189411)
2026-07-16 [email protected] Roll Skia from ab2410bc857c to 37c5e6b26aee (19 revisions) (flutter/flutter#189549)
2026-07-16 [email protected] [ios] Fix //flutter:unittests build for physical devices (flutter/flutter#189543)
2026-07-16 [email protected] Fix lower DragTarget not being recognized in overlapping targets (flutter/flutter#188979)
2026-07-16 [email protected] Relocate cupertino samples that were under widgets/ (flutter/flutter#188876)
2026-07-15 [email protected] [iOS] Migrate DisplayLinkManager to a shared instance (flutter/flutter#189492)
2026-07-15 [email protected] [Impeller] Call glfwTerminate during global test environment teardown if a playground test called glfwInit (flutter/flutter#189523)
2026-07-15 [email protected] Roll pub packages (flutter/flutter#189515)
2026-07-15 [email protected] Roll Packages from ad2eab1 to 9f95026 (8 revisions) (flutter/flutter#189509)
2026-07-15 [email protected] add `@nonVirtual` to `RenderObject.attached`, fix `WidgetTester.hasRunningAnimations` (flutter/flutter#186832)
2026-07-15 [email protected] Roll vulkan-deps to 0582f446e54a (flutter/flutter#188524)
2026-07-15 [email protected] Roll Dart SDK from 0c408ff6dce9 to d402ff7c9c84 (1 revision) (flutter/flutter#189497)

If this roll has caused a breakage, revert this CL and stop the roller
using the controls here:
https://autoroll.skia.org/r/flutter-packages
Please CC [email protected],[email protected] on the revert to ensure that a human
is aware of the problem.
...
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@hellohuanlin hellohuanlin hellohuanlin approved these changes
+1 more reviewer
@gemini-code-assist gemini-code-assist[bot] gemini-code-assist[bot] left review comments
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

a: accessibility Accessibility, e.g. VoiceOver or TalkBack. (aka a11y) CICD Run CI/CD engine flutter/engine related. See also e: labels. platform-ios iOS applications specifically team-ios Owned by iOS platform team

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@cbracken @hellohuanlin