Report's `Application Specific Information` contains random contents of memory

[sebastienboisvert]

Platform

macOS

Environment

Production

Installed

Swift Package Manager

Version

8.56.2

Xcode Version

26.2

Did it work on previous versions?

No response

Steps to Reproduce

We've noticed on several reports that the "Application Specific Information" section of the crashes seem to contain random contents of memory, rather than actual application crash data:

• often see partial/truncated stack information (that doesn't seem to relate to the actual crash)
• in one case it contained a portion of an email message (not something we would include in reports), or other random data; we feel this presents a risk of privacy/security since this random memory data can potentially contain PII
• in the examples provided, a common cause of the crash is a stack overflow due to excessive recursion, but may not always be the cause in all cases we've seen this random data
• to us this looks like bad pointer arithmetic
• there's no specific steps to "reproduce" this that we can determine
• given the unpredictable nature of the random data that may be present, we don't think we could reliably do any scrubbing of that information when submitting the report from the application.
• see the attached reports for examples/comparison

Our Sentry config options are:

options.enableAppHangTracking = NO;
options.enableSwizzling = NO;
options.enableCaptureFailedRequests = NO;
options.experimental.enableUnhandledCPPExceptionsV2  = YES;

Other notes:
The examples include reports retrieved from Sentry, as well as the same crashes retrieved from the user's machine (when available). We noted the reported thread numbers were off-by-one, as are some of the binary image addresses. The reports were correlated by launch time and other values common in each report source.

Expected Result

Crash reports retrieved from the user's machine:

User retrieved crashes.zip

Actual Result

The same crashes retrieved from Sentry:
Sentry retrieved crashes.zip

Are you willing to submit a PR?

No response

[linear]

COCOA-1199

[philipphofmann]

The content displayed after "Application Specific Information:" in the downloaded crash report comes from event.exception.values[0].value

The download functionality in [event_apple_crash_report.py](https://github.com/getsentry/sentry/blob/54d5115a50e/src/sen
try/api/endpoints/event_apple_crash_report.py extracts event.exception.values[0] and appends its value
field as "Application Specific Information".

So my guess is that this info stems from here

sentry-cocoa/Sources/Sentry/SentryCrashReportConverter.m

Lines 494 to 548 in 9b1137e

	- (void)enhanceValueFromNotableAddresses:(SentryException *)exception
	{
	// Gatekeeper fixes https://github.com/getsentry/sentry-cocoa/issues/231
	if ([self.threads count] == 0 || self.crashedThreadIndex >= [self.threads count]) {
	return;
	}
	NSDictionary *crashedThread = self.threads[self.crashedThreadIndex];
	NSDictionary *_Nullable notableAddresses = crashedThread[@"notable_addresses"];
	NSMutableOrderedSet *reasons = [[NSMutableOrderedSet alloc] init];
	if (nil != notableAddresses) {
	for (id key in notableAddresses) {
	NSDictionary *content = notableAddresses[key];
	if ([content[@"type"] isEqualToString:@"string"] && nil != content[@"value"]) {
	// if there are less than 3 slashes it shouldn't be a filepath
	if ([[content[@"value"] componentsSeparatedByString:@"/"] count] < 3) {
	[reasons addObject:SENTRY_UNWRAP_NULLABLE(NSString, content[@"value"])];
	}
	}
	}
	}
	if (reasons.count > 0) {
	exception.value = [[[reasons array] sortedArrayUsingSelector:@selector
	(localizedCaseInsensitiveCompare:)] componentsJoinedByString:@" > "];
	}
	}
	- (void)enhanceValueFromCrashInfoMessage:(SentryException *)exception
	{
	NSMutableArray<NSString *> *crashInfoMessages = [NSMutableArray new];
	NSPredicate *libSwiftCore =
	[NSPredicate predicateWithBlock:^BOOL(id object, NSDictionary *bindings) {
	NSDictionary *binaryImage = object;
	return [binaryImage[@"name"] containsString:@"libswiftCore.dylib"];
	}];
	NSArray *libSwiftCoreBinaryImages =
	[self.binaryImages filteredArrayUsingPredicate:libSwiftCore];
	for (NSDictionary *binaryImage in libSwiftCoreBinaryImages) {
	if (binaryImage[@"crash_info_message"] != nil) {
	[crashInfoMessages
	addObject:SENTRY_UNWRAP_NULLABLE(NSString, binaryImage[@"crash_info_message"])];
	}
	if (binaryImage[@"crash_info_message2"] != nil) {
	[crashInfoMessages
	addObject:SENTRY_UNWRAP_NULLABLE(NSString, binaryImage[@"crash_info_message2"])];
	}
	}
	NSString *swiftCoreCrashInfo = crashInfoMessages.firstObject;
	if (swiftCoreCrashInfo != nil) {
	exception.value = swiftCoreCrashInfo;
	}
	}

As you correctly pointed out, this could happen only for crashes such as

Exception Type:    EXC_BAD_ACCESS (SIGBUS)
Exception Subtype: KERN_PROTECTION_FAILURE at 0x000000016dddfff0
Exception Message: Thread stack size exceeded due to excessive recursion
Exception Codes:   0x0000000000000002, 0x000000016dddfff0

Swift recursion crash doesn't lead to this problem. When running this code

private func causeStackOverflow(depth: Int) {
    // Allocate some stack space to consume it faster
    var localArray = Array(repeating: depth, count: 100)
    localArray[0] = depth + 1

    // Recurse infinitely until stack exhausted
    causeStackOverflow(depth: localArray[0])
}

we get in Sentry

Exception Type: EXC_BAD_ACCESS (SIGBUS)
Exception Codes: BUS_NOOP at 0x000000016f61ffe8
Crashed Thread: 15

Application Specific Information:
Exception 1, Code 2, Subcode 6163660776 >
Stack overflow

Thread 15 Crashed:
0   libswiftCore.dylib              0x32e445a60         swift::StableAddressConcurrentReadableHashMap<T>::getOrInsert<T>
1   libswiftCore.dylib              0x32e445780         swift::LockingConcurrentMap<T>::getOrInsert<T>
2   libswiftCore.dylib              0x32e434a40         _swift_getGenericMetadata
3   libswiftCore.dylib              0x32e7ab8e4         __swift_instantiateCanonicalPrespecializedGenericMetadata
4   libswiftCore.dylib              0x32e4f1f44         _ContiguousArrayBuffer.init
5   libswiftCore.dylib              0x32e4fa69c         Array._allocateUninitialized
6   libswiftCore.dylib              0x32e777bd4         Array.init
7   libswiftCore.dylib              0x32e54fc28         Array.init

But I now found a repro with Claude:

Issue
Exception value shows <%@> > for stack overflow crashes during string building operations.

Root Cause
SentryCrashReportConverter.m:494-518 (enhanceValueFromNotableAddresses) extracts string values from notable addresses
in crashed thread memory, joining them with " > " separator. When a stack overflow occurs during NSMutableString appendFormat: operations, partially constructed strings are captured from memory.

Reproduction
Create circular reference with KVC-triggered recursion that builds strings:

// RecursiveNode.m                                                                                                       
- (NSString *)outerHTML {                                                                                                
    NSMutableString *html = [NSMutableString string];                                                                    
    [html appendFormat:@"<%@>", self.name];  // Partial string captured at crash                                         
    [html appendString:[self innerHTML]];                                                                                
    return html;                                                                                                         
}                                                                                                                        
                                                                                                                         
- (NSString *)innerHTML {                                                                                                
    return [[self.children valueForKey:@"outerHTML"] componentsJoinedByString:@""];                                      
}                                                                                                                        
                                                                                                                         
// Create A->B->A circular reference                                                                                     
nodeA.children = @[nodeB];                                                                                               
nodeB.children = @[nodeA];                                                                                               
[nodeA outerHTML];  // Crashes with "<%@> >" exception value                                                             

The <%@> format string is extracted from stack memory where appendFormat: was executing when the stack overflowed.

Code references:

• SentryCrashReportConverter.m:506-509 (filters string-type notable addresses)
• SentryCrashReportConverter.m:515-516 (joins with " > " separator)

I think in this edge case above the exception message should be Thread stack size exceeded due to excessive recursion just as for swift recursions.

Prompt to create repro with claude code

⏺ # Add Stack Overflow Crash Reproduction to iOS-Swift Sample

Objective

Add a crash button to the iOS-Swift sample app that reproduces a stack overflow crash with partial string exception
values (e.g., <%@> >). This mimics HTMLKit-style crashes where KVC-triggered recursion builds strings during infinite
loops.

Context

The crash demonstrates an edge case where SentryCrashReportConverter.m:enhanceValueFromNotableAddresses extracts
partially constructed NSMutableString values from memory when stack overflow occurs during appendFormat: operations.

Implementation Steps

1. Create RecursiveNode.h

Path: Samples/iOS-Swift/iOS-Swift/Tools/RecursiveNode.h

#import <Foundation/Foundation.h>                                                                                        
                                                                                                                         
NS_ASSUME_NONNULL_BEGIN                                                                                                  
                                                                                                                         
/// A tree node that mimics HTMLKit's crash pattern through KVC-based recursive serialization.                           
/// This class demonstrates the crash: EXC_BAD_ACCESS (SIGBUS) with KERN_PROTECTION_FAILURE                              
/// Exception Message: Thread stack size exceeded due to excessive recursion                                             
///                                                                                                                      
/// The crash pattern mirrors HTMLKit's outerHTML/innerHTML cycle:                                                       
/// outerHTML -> innerHTML -> [children valueForKey:@"outerHTML"] -> outerHTML -> innerHTML -> ...                       
@interface RecursiveNode : NSObject                                                                                      
                                                                                                                         
@property (nonatomic, copy) NSString *name;                                                                              
@property (nonatomic, strong, nullable) NSArray<RecursiveNode *> *children;                                              
                                                                                                                         
- (instancetype)initWithName:(NSString *)name;                                                                           
                                                                                                                         
/// Creates a circular tree structure that will cause stack overflow when serialized                                     
+ (RecursiveNode *)createCircularStructure;                                                                              
                                                                                                                         
/// Returns the outer HTML representation, which triggers innerHTML on children                                          
/// Similar to HTMLKit's -[HTMLElement outerHTML]                                                                        
- (NSString *)outerHTML;                                                                                                 
                                                                                                                         
/// Returns the inner HTML representation by calling outerHTML on all children via KVC                                   
/// Similar to HTMLKit's -[HTMLNode innerHTML]                                                                           
- (NSString *)innerHTML;                                                                                                 
                                                                                                                         
@end                                                                                                                     
                                                                                                                         
NS_ASSUME_NONNULL_END                                                                                                    
                                                                                                                         
2. Create RecursiveNode.m                                                                                                
                                                                                                                         
Path: Samples/iOS-Swift/iOS-Swift/Tools/RecursiveNode.m                                                                  
                                                                                                                         
#import "RecursiveNode.h"                                                                                                
                                                                                                                         
@implementation RecursiveNode                                                                                            
                                                                                                                         
- (instancetype)initWithName:(NSString *)name {                                                                          
    self = [super init];                                                                                                 
    if (self) {                                                                                                          
        _name = name;                                                                                                    
    }                                                                                                                    
    return self;                                                                                                         
}                                                                                                                        
                                                                                                                         
+ (RecursiveNode *)createCircularStructure {                                                                             
    // Create a simple circular structure with just two nodes                                                            
    // This guarantees immediate recursion: A -> B -> A -> B -> ...                                                      
    RecursiveNode *nodeA = [[RecursiveNode alloc] initWithName:@"div"];                                                  
    RecursiveNode *nodeB = [[RecursiveNode alloc] initWithName:@"p"];                                                    
                                                                                                                         
    // Direct circular reference: A contains B, B contains A                                                             
    // This creates immediate infinite loop:                                                                             
    // nodeA.outerHTML -> nodeA.innerHTML -> [children valueForKey:@"outerHTML"] ->                                      
    // nodeB.outerHTML -> nodeB.innerHTML -> [children valueForKey:@"outerHTML"] ->                                      
    // nodeA.outerHTML -> ... (infinite recursion)                                                                       
    nodeA.children = @[nodeB];                                                                                           
    nodeB.children = @[nodeA];                                                                                           
                                                                                                                         
    return nodeA;                                                                                                        
}                                                                                                                        
                                                                                                                         
- (NSString *)outerHTML {                                                                                                
    // Similar to HTMLKit's -[HTMLElement outerHTML] (HTMLElement.m:182)                                                 
    // Creates the opening tag, gets innerHTML, then closing tag                                                         
    NSMutableString *html = [NSMutableString string];                                                                    
                                                                                                                         
    [html appendFormat:@"<%@>", self.name];                                                                              
                                                                                                                         
    // This calls innerHTML which triggers KVC on children                                                               
    // Matching the stack trace pattern at HTMLElement.m:182                                                             
    NSString *inner = [self innerHTML];                                                                                  
    [html appendString:inner];                                                                                           
                                                                                                                         
    [html appendFormat:@"</%@>", self.name];                                                                             
                                                                                                                         
    return [html copy];                                                                                                  
}                                                                                                                        
                                                                                                                         
- (NSString *)innerHTML {                                                                                                
    // Similar to HTMLKit's -[HTMLNode innerHTML] (HTMLNode.m:727)                                                       
    // Uses KVC to get outerHTML from all children                                                                       
    // This is the key that causes the recursion via valueForKey:                                                        
                                                                                                                         
    if (!self.children || self.children.count == 0) {                                                                    
        return @"";                                                                                                      
    }                                                                                                                    
                                                                                                                         
    // This line mimics HTMLNode.m:727 and triggers the recursive pattern:                                               
    // -[NSArray(NSKeyValueCoding) valueForKey:] calls outerHTML on each child                                           
    // which calls innerHTML on their children, creating the infinite loop                                               
    NSArray *childrenHTML = [self.children valueForKey:@"outerHTML"];                                                    
                                                                                                                         
    // Join all children's HTML                                                                                          
    return [childrenHTML componentsJoinedByString:@""];                                                                  
}                                                                                                                        
                                                                                                                         
// Override description to trigger the crash when printing the object                                                    
- (NSString *)description {                                                                                              
    return [self outerHTML];                                                                                             
}                                                                                                                        
                                                                                                                         
@end                                                                                                                     
                                                                                                                         
3. Update Bridging Header                                                                                                
                                                                                                                         
Path: Samples/iOS-Swift/iOS-Swift/Tools/iOS-Swift-Bridging-Header.h                                                      
                                                                                                                         
Add this import to expose RecursiveNode to Swift:                                                                        
#import "RecursiveNode.h"                                                                                                
                                                                                                                         
4. Update ErrorsViewController.swift                                                                                     
                                                                                                                         
Path: Samples/iOS-Swift/iOS-Swift/ErrorsViewController.swift                                                             
                                                                                                                         
Find the crash(_ sender: UIButton) method and replace it with:                                                           
@IBAction func crash(_ sender: UIButton) {                                                                               
    // Create a circular tree structure in Objective-C                                                                   
    // Mimics HTMLKit's crash pattern through KVC-based recursive serialization                                          
    // Pattern: outerHTML -> innerHTML -> [children valueForKey:@"outerHTML"] -> outerHTML -> ...                        
    // causing: EXC_BAD_ACCESS (SIGBUS) KERN_PROTECTION_FAILURE                                                          
    // Exception Message: Thread stack size exceeded due to excessive recursion                                          
    let node = RecursiveNode.createCircularStructure()                                                                   
    _ = node.outerHTML()                                                                                                 
}                                                                                                                        
                                                                                                                         
5. Add Files to Xcode Project                                                                                            
                                                                                                                         
Path: Samples/iOS-Swift/iOS-Swift.xcodeproj/project.pbxproj                                                              
                                                                                                                         
The RecursiveNode.h and RecursiveNode.m files need to be added to the Xcode project:                                     
                                                                                                                         
1. Add PBXBuildFile entry for RecursiveNode.m in the /* Begin PBXBuildFile section */                                    
2. Add PBXFileReference entries for both RecursiveNode.h and RecursiveNode.m in the /* Begin PBXFileReference section */ 
3. Add both files to the Tools group                                                                                     
4. Add RecursiveNode.m to the PBXSourcesBuildPhase for the iOS-Swift target                                              
                                                                                                                         
Generate three unique 24-character hex IDs for:                                                                          
- PBXBuildFile for RecursiveNode.m                                                                                       
- PBXFileReference for RecursiveNode.m                                                                                   
- PBXFileReference for RecursiveNode.h                                                                                   
                                                                                                                         
6. Build and Verify                                                                                                      
                                                                                                                         
Compile the iOS-Swift sample app:                                                                                        
xcodebuild -project Samples/iOS-Swift/iOS-Swift.xcodeproj -scheme iOS-Swift -sdk iphonesimulator -destination            
'platform=iOS Simulator,name=iPhone 17' build                                                                            
                                                                                                                         
Expected Behavior                                                                                                        
                                                                                                                         
When the crash button is tapped:                                                                                         
1. Stack overflow occurs during string building (appendFormat:@"<%@>")                                                   
2. Crash type: EXC_BAD_ACCESS (SIGBUS) KERN_PROTECTION_FAILURE                                                           
3. Exception value: <%@> > (extracted from notable addresses in memory)                                                  
4. Stack trace shows KVC recursion: outerHTML -> innerHTML -> valueForKey: -> outerHTML -> ...                           
                                                                                                                         
Technical Details                                                                                                        
                                                                                                                         
- The <%@> string is captured from stack memory where NSMutableString appendFormat: was executing                        
- SentryCrashReportConverter.m:enhanceValueFromNotableAddresses extracts these partial strings                           
- Strings are joined with " > " separator (line 516)                                                                     
- This reproduces real-world crashes seen with HTMLKit's circular DOM structures                                         
                                                                                                                         
Files to Create/Modify                                                                                                   
                                                                                                                         
- ✅ Create: Samples/iOS-Swift/iOS-Swift/Tools/RecursiveNode.h                                                           
- ✅ Create: Samples/iOS-Swift/iOS-Swift/Tools/RecursiveNode.m                                                           
- ✅ Modify: Samples/iOS-Swift/iOS-Swift/Tools/iOS-Swift-Bridging-Header.h (add import)                                  
- ✅ Modify: Samples/iOS-Swift/iOS-Swift/ErrorsViewController.swift (update crash method)                                
- ✅ Modify: Samples/iOS-Swift/iOS-Swift.xcodeproj/project.pbxproj (add files to project)       


</p>
</details> 

[cobyeastwood183]

https://sentry.zendesk.com/agent/tickets/172376