Skip to main content

Improper resource allocation - Memory leak

Need​

Proper resource management and deallocation

Context​

  • Usage of Swift 5.0 for iOS app development
  • Usage of UIKit for building modern and responsive user interfaces
  • Usage of Foundation for building responsive and accessible web interfaces

Description​

Non compliant code​

class ViewController: UIViewController {
    var data: Data? = nil

    override func viewDidLoad() {
        super.viewDidLoad()
        let url = URL(string: "https://example.com")!
        let task = URLSession.shared.dataTask(with: url) { (data, response, error) in
            if let data = data {
                self.data = data
            }
        }
        task.resume()
    }
}

In the above Swift code, a data task is created to fetch data from a URL. This data is then stored in a variable data which is a property of the ViewController class.

The vulnerability in this code is a memory leak due to improper resource allocation. The data task that is created with URLSession.shared.dataTask(with: url) is not properly released after it has finished its operation. This means that the memory allocated for this task is not returned back to the system and will remain occupied even after the task has completed its operation.

This can lead to a significant memory leak if this operation is performed multiple times, as each time, new memory will be allocated for the task, but the previously allocated memory will not be released.

This type of vulnerability can lead to decreased performance of the app and in severe cases can cause the app to crash due to out of memory errors. It's important to ensure that any resources that are allocated are also properly deallocated when they are no longer needed.

Steps​

  • Explicitly close the resources that have been opened
  • In this case, close the URLSession data task by calling the cancel() method
  • Ensure that the resources are released properly to avoid memory leaks

Compliant code​

class ViewController: UIViewController {
    var data: Data? = nil
    var task: URLSessionDataTask? = nil

    override func viewDidLoad() {
        super.viewDidLoad()
        let url = URL(string: "https://example.com")!
        task = URLSession.shared.dataTask(with: url) { [weak self] (data, response, error) in
            if let data = data {
                self?.data = data
            }
        }
        task?.resume()
    }
    
    deinit {
        task?.cancel()
    }
}

The updated code includes a task property to hold the URLSessionDataTask. This allows us to cancel the task when the ViewController is deallocated, which is done in the deinit method.

The deinit method is a special method in Swift that gets called when an instance of a class is deallocated. By calling task?.cancel() in deinit, we ensure that the URLSessionDataTask is cancelled when the ViewController is no longer in use, which helps to prevent memory leaks.

Also, we have added [weak self] in the closure to avoid a strong reference cycle between the ViewController and the URLSessionDataTask. This is because the URLSessionDataTask has a strong reference to the closure, and if the closure has a strong reference to the ViewController (which it does if we use self without weak), it creates a strong reference cycle that can lead to a memory leak. By using weak self, we break the strong reference cycle and further prevent memory leaks.

References​

Last updated on