From c33084cc94c44493a39085932dbbeb7678fde342 Mon Sep 17 00:00:00 2001
From: David Aurelio <davidaurelio@fb.com>
Date: Tue, 12 Jul 2016 10:11:42 -0700
Subject: [PATCH] Read within bounds of `NSData` object

Summary: This prevents the `isUnbundle` check to read beyond the end of an `NSData` instance by using `getBytes:length:` instead of accessing the underlying buffer directly.

Reviewed By: javache

Differential Revision: D3548874

fbshipit-source-id: 7c93c66cc6abb4a2a321888ab394212f4d14a03e
---
 React/Executors/RCTJSCExecutor.mm | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/React/Executors/RCTJSCExecutor.mm b/React/Executors/RCTJSCExecutor.mm
index 7359c03687..deab6281e7 100644
--- a/React/Executors/RCTJSCExecutor.mm
+++ b/React/Executors/RCTJSCExecutor.mm
@@ -730,8 +730,9 @@ static NSData *loadPossiblyBundledApplicationScript(NSData *script, NSURL *sourc
                                                     NSError **error)
 {
   // The RAM bundle has a magic number in the 4 first bytes `(0xFB0BD1E5)`.
-  uint32_t magicNumber = NSSwapLittleIntToHost(*((uint32_t *)script.bytes));
-  isRAMBundle = magicNumber == RCTRAMBundleMagicNumber;
+  uint32_t magicNumber = 0;
+  [script getBytes:&magicNumber length:sizeof(magicNumber)];
+  isRAMBundle = NSSwapLittleIntToHost(magicNumber) == RCTRAMBundleMagicNumber;
   if (isRAMBundle) {
     [performanceLogger markStartForTag:RCTPLRAMBundleLoad];
     script = loadRAMBundle(sourceURL, error, randomAccessBundle);