Merge pull request Expensify#91076 from software-mansion-labs/war-in/fix-uaf-crash

Author: mountiny

patches/react-native/details.md

@@ -265,6 +265,12 @@
 - Upstream PR/issue: [facebook/react-native#51835](https://github.com/facebook/react-native/pull/51835)
 - E/App issue: [#59953](https://github.com/Expensify/App/issues/59953)
 
+### [react-native+0.83.1+036+fix-turbomodule-event-emitter-uaf.patch](react-native+0.83.1+036+fix-turbomodule-event-emitter-uaf.patch)
+
+- Reason: Fixes an Android use-after-free crash in `JavaTurboModule::configureEventEmitterCallback`. The event-emitter callback lambda captured `this` by reference (`[&]`), so when the C++ TurboModule was deallocated (e.g. on screen unmount) a background thread invoking the callback would dereference freed memory via `eventEmitterMap_[name]` and crash with `SIGSEGV`. The fix copies the `shared_ptr` map by value into the lambda and replaces `operator[]` with `find()` + null-check, which both keeps the map alive for the callback's lifetime and avoids inserting empty entries on missing keys.
+- Upstream PR/issue: [facebook/react-native#55398](https://github.com/facebook/react-native/pull/55398)
+- E/App issue: [#90623](https://github.com/Expensify/App/issues/90623)
+
 ### [react-native+0.83.1+036+rounded-inline-code-background.patch](react-native+0.83.1+036+rounded-inline-code-background.patch)
 
 - Reason: Draws inline code block background with rounded corners on iOS when `borderTopLeftRadius` is set.

patches/react-native/react-native+0.83.1+036+fix-turbomodule-event-emitter-uaf.patch

@@ -0,0 +1,28 @@
+diff --git a/node_modules/react-native/ReactCommon/react/nativemodule/core/platform/android/ReactCommon/JavaTurboModule.cpp b/node_modules/react-native/ReactCommon/react/nativemodule/core/platform/android/ReactCommon/JavaTurboModule.cpp
+index 5c9b464..5766844 100644
+--- a/node_modules/react-native/ReactCommon/react/nativemodule/core/platform/android/ReactCommon/JavaTurboModule.cpp
++++ b/node_modules/react-native/ReactCommon/react/nativemodule/core/platform/android/ReactCommon/JavaTurboModule.cpp
+@@ -982,12 +982,17 @@ void JavaTurboModule::configureEventEmitterCallback() {
+     FACEBOOK_JNI_THROW_PENDING_EXCEPTION();
+   }
+
+-  auto callback = JCxxCallbackImpl::newObjectCxxArgs([&](folly::dynamic args) {
+-    auto eventName = args.at(0).asString();
+-    auto& eventEmitter = static_cast<AsyncEventEmitter<folly::dynamic>&>(
+-        *eventEmitterMap_[eventName].get());
+-    eventEmitter.emit(args.size() > 1 ? std::move(args).at(1) : nullptr);
+-  });
++  auto emitterMap = eventEmitterMap_;
++  auto callback =
++      JCxxCallbackImpl::newObjectCxxArgs([emitterMap](folly::dynamic args) {
++        auto eventName = args.at(0).asString();
++        auto it = emitterMap.find(eventName);
++        if (it != emitterMap.end() && it->second) {
++          auto& eventEmitter =
++              static_cast<AsyncEventEmitter<folly::dynamic>&>(*it->second);
++          eventEmitter.emit(args.size() > 1 ? std::move(args).at(1) : nullptr);
++        }
++      });
+
+   jvalue args[1];
+   args[0].l = callback.release();