From 27f78d1a06820a84466090d80ac48429ea18cf49 Mon Sep 17 00:00:00 2001 From: Pasin Suriyentrakorn Date: Tue, 18 Aug 2026 13:59:48 -0700 Subject: [PATCH] CBL-8727 : Fix use after free in the lazy vector index tests Cherry-Picked directly from master branch (db1abd2b6fbae85c8fc75eacb589ac3a60f5f150) vectorForWord: returned the CBLArray from a query result, cast to NSArray. That array is only valid while the result set is alive, so callers read freed memory once the enumeration ended. The result was an EXC_BAD_ACCESS crash inside -[CBLIndexUpdater setVector:atIndex:error:] and wrong vectors in the assertions. It only showed up when running against release builds. Copy the values out with -[CBLArray toArray] instead. --- Objective-C/Tests/VectorSearchTest+Lazy.m | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/Objective-C/Tests/VectorSearchTest+Lazy.m b/Objective-C/Tests/VectorSearchTest+Lazy.m index e9967600e..95f30a3a8 100644 --- a/Objective-C/Tests/VectorSearchTest+Lazy.m +++ b/Objective-C/Tests/VectorSearchTest+Lazy.m @@ -69,9 +69,11 @@ - (CBLVectorIndexConfiguration*) lazyVectorIndexConfigWithExpression: (NSString* NSArray* vector; CBLQueryResult *result = [rs nextObject]; if (result) { - id value = [result arrayAtIndex: 0]; + CBLArray* value = [result arrayAtIndex: 0]; if (value) { - vector = (NSArray*)value; + // Copy the values out of the fleece-backed CBLArray, which is only + // valid while the result set is alive: + vector = (NSArray*)[value toArray]; } } return vector;