Crash: CRYPTO_malloc

[DevOpsAppsIOL]

Describe the bug
The app crash when it detects a security threat.

To Reproduce
The issue has been detected on some users through firebase crashlytics.
I was not able to replicate the crash but from the logs I see that the problem always occurs on: screenRecording and screenshot.

Expected behavior
I expect zero crashes

Screenshots

Please complete the following information:
Crash:
CRYPTO_malloc.txt

Additional context
Also, trying to launch the debug app with Enable Address Sanitizer active I immediately get this crash

[msikyna]

Hello @DevOpsAppsIOL ,
can you elaborate on how many devices does this crash occur (out of how many). Also the models and os versions of these devices? Thank you!

Kind regards,
Talsec team

[DevOpsAppsIOL]

Hello @msikyna ,
The crashes occur on all iPhone/iPad models from the last 5 years and use these iOS versions:

• iOS 18.5.0
• iOS 18.4.1
• iOS 18.3.2

There are now about 208 devices with crashes and 210 events.

I see from the logs that before crashing there is the SecurityService Found incident: screenRecording log
in 80% of cases. The remaining 20% have no log.

public func threatDetected(_ securityThreat: SecurityThreat) { CrashlyticsRecords.shared.log(msg: "SecurityService Found incident: \(securityThreat.rawValue)") .... .... .... }

[DevOpsAppsIOL]

Hi @msikyna,
crashes are on the rise. I reached 700 crashes.

[arisupriatna14]

Hi @DevOpsAppsIOL

May I know what the version are you used in? Since I'm just starting implement for prevent screenshot and screen recording in my app and I don't want my app crash because this issue.

Thank you

[DevOpsAppsIOL]

Hi @arisupriatna14,
I integrated the latest version (6.11.0).

[msikyna]

Hello @DevOpsAppsIOL ,
thank you for adding details. Can you also supply how many running instances do you have? So we can estimate on what percentage of devices the incident happens.
Moreover, did it also happen with 6.10.0 version? Thank you!

[DevOpsAppsIOL]

Hello @msikyna,
we integrated your SDK for the first time starting from 6.11.0. We have reached more than 1000 crashes. The crashes concern about 1% of the total instances. The app is from https://www.italiaonline.it/ and has a very large audience.

[msikyna]

Hello,
we just released a new version. Could you try integrating it and see whether it solves the issue? Thank you!
https://github.com/talsec/Free-RASP-iOS/releases/tag/v6.12.1

[DevOpsAppsIOL]

Hello @msikyna ,
Thanks for the new release. I hope it fixes the various crashes. I'll update you in the coming weeks.