Summary

• Fix 64-bit memory corruption bug in keyCodeForChar function on macOS
• Use pointer-sized intermediate variable for CFDictionaryGetValueIfPresent output
• Add explicit uintptr_t cast for integer-to-pointer conversion

Problem

The keyCodeForChar function in src/macos/keycode.c had a critical 64-bit memory corruption bug:

CGKeyCode code;  // uint16_t - only 2 bytes
CFDictionaryGetValueIfPresent(charToCodeDict, charStr, (const void **)&code);

According to Apple's CFDictionary documentation, the value parameter of CFDictionaryGetValueIfPresent is:

"A pointer to memory which should be filled with the pointer-sized value if a matching key is found."

On 64-bit systems, this function writes 8 bytes, but CGKeyCode (uint16_t) is only 2 bytes. This causes stack memory corruption by overwriting 6 adjacent bytes.

Solution

Use a pointer-sized intermediate variable:

void *value = NULL;
CGKeyCode code;
if (!CFDictionaryGetValueIfPresent(charToCodeDict, charStr, (const void **)&value))
{
    code = UINT16_MAX;
}
else
{
    code = (CGKeyCode)(uintptr_t)value;
}

Also added explicit uintptr_t cast when storing values:

CFDictionaryAddValue(charToCodeDict, string, (const void *)(uintptr_t)i);

References

• Apple CF/CFDictionary.h - CFDictionaryGetValueIfPresent documentation - States value parameter is "pointer-sized"
• Microsoft: Rules for Using Pointers (64-bit) - General guidance on 64-bit pointer handling
• A Collection of Examples of 64-bit Errors in Real Programs - Documents similar CFDictionary bugs