Skip to content

[iOS] Fixed crash when textinput's default value exceeds maxLength - #24084

Closed
zhongwuzw wants to merge 1 commit into
react:masterfrom
zhongwuzw:fix_input_crash
Closed

[iOS] Fixed crash when textinput's default value exceeds maxLength#24084
zhongwuzw wants to merge 1 commit into
react:masterfrom
zhongwuzw:fix_input_crash

Conversation

@zhongwuzw

Copy link
Copy Markdown
Contributor

Summary

Bug comes from #23545, if allowedLength < 0, it would crash if text.length > 1.

cc. @cpojer

Changelog

[iOS] [Fixed] - Fixed crash when textinput's default value exceeds maxLength

Test Plan

paste text which length bigger than 1, it would not crash.

 <View style={styles.exampleContainer}>
<Header title="RNTester" />
<TextInput value={'12345678'} maxLength={6}/>
</View>

@facebook-github-botfacebook-github-bot added the CLA Signed This label is managed by the Facebook bot. Authors need to sign the CLA before a PR can be reviewed. label Mar 21, 2019

@cpojercpojer left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍

@facebook-github-botfacebook-github-bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@cpojer is landing this pull request. If you are a Facebook employee, you can view this diff on Phabricator.

@react-native-bot

Copy link
Copy Markdown
Collaborator

This pull request was successfully merged by @zhongwuzw in bbd98d5.

When will my fix make it into a release? | Upcoming Releases

@react-native-botreact-native-bot added the Merged This PR has been merged. label Mar 22, 2019
@shupingchu

Copy link
Copy Markdown

I encounter the new crash issue if paste the text exceeds maxLength limit, and click undo, app crashed. Not sure if you seen this before?

Error thrown in xcode

*** Terminating app due to uncaught exception 'NSRangeException', reason: 'NSMutableRLEArray replaceObjectsInRange:withObject:length:: Out of bounds'
*** First throw call stack:
(0x180aa79d8 0x194e2ab54 0x181c618a0 0x181c8955c 0x1896ac048 0x1896abd14 0x18961aed0 0x189620574 0x18363ab8c 0x181ccf40c 0x181ccd11c 0x1c882fc04 0x1835c0598 0x183318f38 0x1030f7940 0x182904218 0x1886cc934 0x183318f38 0x1030f7940 0x182cae184 0x182cae4c8 0x182cace00 0x183353bc0 0x1833554e8 0x183330b0c 0x1c8848d6c 0x1833b3078 0x1833b7818 0x1833aeafc 0x180a27bf0 0x180a27af0 0x180a26e38 0x180a213e0 0x180a20ba0 0x197786598 0x1833122f4 0x183317874 0x10285f828 0x1806ff568)
libc++abi.dylib: terminating with uncaught exception of type NSException
Screen.Recording.2024-06-10.at.4.04.32.PM.online-video-cutter.com.mp4

@zhongwuzw

Copy link
Copy Markdown
ContributorAuthor

@shupingchu Hi, can you create an issue to provide the repo that we can investigate it.

@shupingchu

Copy link
Copy Markdown

@shupingchu Hi, can you create an issue to provide the repo that we can investigate it.

Created #45050

meta-codesyncBot pushed a commit that referenced this pull request Mar 10, 2026
Summary:
The existing range guard in the UITextView delegate (added in #24084) only checks range.location + range.length > text.length. It doesn't handle range.location > text.length, which causes an unsigned integer underflow in the clamped length, still crashing with NSRangeException. See #45050 for another report of this.
The UITextField delegate has no range validation at all.
This PR adds a range.location > textLength early return to both delegate adapters, ahead of the existing length clamping.
## Changelog:
<!-- Help reviewers and the release process by writing your own changelog entry.
Pick one each for the category and type tags:
[ANDROID|GENERAL|IOS|INTERNAL] [BREAKING|ADDED|CHANGED|DEPRECATED|REMOVED|FIXED|SECURITY] - Message
For more details, see:
https://reactnative.dev/contributing/changelogs-in-pull-requests
-->
[IOS] [FIXED] - Fix NSRangeException crash in RCTBackedTextInputDelegateAdapter when text range is out of bounds
Pull Request resolved: #55950
Test Plan: This is a race condition between iOS computing the text range and React Native updating the backing text (e.g. controlled TextInput state updates, maxLength truncation, autocorrect). It's difficult to reproduce deterministically but shows up in production crash logs. The fix is straightforward defensive bounds checking before calling replaceCharactersInRange:.
Reviewed By: shwanton
Differential Revision: D95564295
Pulled By: cipolleschi
fbshipit-source-id: 721e803f03e973be462a18fd3f5d7a5aeb073b3e
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

CLA SignedThis label is managed by the Facebook bot. Authors need to sign the CLA before a PR can be reviewed.Component: TextInputRelated to the TextInput component.MergedThis PR has been merged.Platform: iOSiOS applications.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants

@zhongwuzw@react-native-bot@shupingchu@cpojer@facebook-github-bot