Crashloop when attachment with size as string is found

[andir]

Steps to reproduce

1. Join a matrix channel
2. Have someone post an attachment into the channel that encodes the file lenght in the FileInfo part (https://spec.matrix.org/v1.6/client-server-api/#mfile) of the m.file event as string rather than integer.
3. Open element on your iPhone / Login to a new profile
4. The app will now crash whenever you open it without any chance to submit a crash report.

Outcome

What did you expect?

I would not expect the app to crash. Not rendering a message, rendering it with an error or just the missing size would be deisreable. Continously crashing the app is not.

What happened instead?

The crash happens in the code responsible for formatting the event to text. There the code assumes that the object in the dictonary is always a number and it is safe to convert it into a long value. The code is missing required type checks in at least these cases.

I've validated the situation using the below patch which fixed it in my simulator. This was my very first piece of Objective-C/iOS development so I don't think this is good enough to go in as a PR.

From 7f8a37836dc601864897629071c917b879d8cd13 Mon Sep 17 00:00:00 2001
From: Andreas Rammhold <[email protected]>
Date: Sat, 4 Mar 2023 11:58:31 +0100
Subject: [PATCH] Fix crash when receiving messages that contain file sizes as
 string
---
 .../Utils/EventFormatter/MXKEventFormatter.m          | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/Riot/Modules/MatrixKit/Utils/EventFormatter/MXKEventFormatter.m b/Riot/Modules/MatrixKit/Utils/EventFormatter/MXKEventFormatter.m
index 9f34bcbb6..e13bc71ba 100644
--- a/Riot/Modules/MatrixKit/Utils/EventFormatter/MXKEventFormatter.m
+++ b/Riot/Modules/MatrixKit/Utils/EventFormatter/MXKEventFormatter.m
@@ -1365,10 +1365,15 @@ static NSString *const kRepliedTextPattern = @"<mx-reply>.*<blockquote>.*<br>(.*
                             NSDictionary *fileInfo = contentToUse[@"info"];
                             if (fileInfo)
                             {
-                                NSNumber *fileSize = fileInfo[@"size"];
-                                if (fileSize)
+                                NSObject* fileSize = fileInfo[@"size"];
+                                if ([fileSize isKindOfClass:[NSNumber class]])
                                 {
-                                    body = [NSString stringWithFormat:@"%@ (%@)", body, [MXTools fileSizeToString: fileSize.longValue]];
+                                    NSNumber* nFileSize = (NSNumber*) fileSize;
+                                    body = [NSString stringWithFormat:@"%@ (%@)", body, [MXTools fileSizeToString: nFileSize.longValue]];
+                                } else if ([fileSize isKindOfClass:[NSString class]]) {
+                                    body = [NSString stringWithFormat:@"%@ (%@)", body, fileSize];
+                                } else {
+                                    // FIXME: add some logging that we can't make sense of the file size attribute?
                                 }
                             }
                         }
-- 
2.39.1

Your phone model

IPhone 14 & IPhone 14 Pro in Simulator

Operating system version

iOS16.3

Application version

latest develop branch (47d50d7)

Homeserver

Synapse 1.76 / my personal instance

Will you send logs?

I did once after turning the homeserver off as otherwise the app continously crashes.