KnowSafe 安全预警：iMessage - Memory Corruption when Decoding NSKnownKeysDictionary1

KnowSafe 安全预警：KnowSafe 安全团队监测到编号 AVD-2019-8660 的安全漏洞（危害等级：严重）已公开披露，相关用户应尽快排查并完成修复。

漏洞介绍

There is a memory corruption vulnerability when decoding an object of class NSKnownKeysDictionary1. This class decodes an object of type NSKnownKeysMappingStrategy1, which decodes a length member which is supposed to represent the length of the keys of the dictionary. However, this member is decoded before the keys are decoded, so if a key is an instance of NSKnownKeysDictionary1 which also uses this instance of NSKnownKeysMappingStrategy1, the mapping strategy will be used before the length is checked. The NSKnownKeysDictionary1 instance uses this length to allocate a buffer, and the length is multiplied by 8 during this allocation without an integer overflow check. The code will then attempt to copy the values array (another decoded parameter) into the buffer using the unmultiplied length.