cua-driver 0.14.1 SIGSEGV on x86_64 macOS 14.1.2 (Sonoma) —

[fengyaojieTTT]

cua-driver 0.14.1 SIGSEGV on x86_64 macOS 14.1.2 (Sonoma) — SLSEventAuthenticationMessageCreateData null ptr in activate_without_raise

Summary

cua-driver 0.14.1 serve daemon crashes with SIGSEGV when performing pixel-coordinate click (via activate_without_raise) on x86_64 macOS 14.1.2 (Sonoma). This is a different crash from #1503 — that issue was NSInvalidArgumentException (ObjC selector not found), this one is EXC_BAD_ACCESS (null pointer dereference) inside the C function SLSEventAuthenticationMessageCreateData.

Crash

Exception:  EXC_BAD_ACCESS (SIGSEGV)
  subtype:   UNKNOWN_0xD at 0x0000000000000000
  signal:    Segmentation fault: 11
  faultingThread: 14 (tokio-rt-worker)

Crash Stack (faulting thread)

0  objc_msgSend
1  _encodeObject
2  +[NSKeyedArchiver archivedDataWithRootObject:requiringSecureCoding:error:]
3  SLSEventAuthenticationMessageCreateData           ← C function, null ptr here
4  _SLEventRecordCreateData(SLEventRecord const*, SLEventCreateDataOptions, unsigned int)
5  CGSEncodeEventRecord
6  SLPSPostEventRecordTo
7  activate_without_raise                           ← cua-driver entry point
8  ClickTool::invoke                                ← click tool handler

Root Cause

The #1503 fix added class_respondsToSelector guard to skip messageWithEventRecord:pid:version: on macOS 14 where the ObjC selector doesn't exist. However, on x86_64 macOS 14.1.2, the code path reaches SLSEventAuthenticationMessageCreateData — a C function (not an ObjC method dispatch) — which internally calls NSKeyedArchiver archivedDataWithRootObject:requiringSecureCoding:error: on an object that is null/invalid, causing SIGSEGV.

The class_respondsToSelector guard from #1503 does5 does not protect against this crash because:

• The C function SLSEventAuthenticationMessageCreateData is called directly (not via ObjC message dispatch)
• The crash happens inside the C function during event record serialization, not at the selector dispatch point

Reproduction

1. Install cua-driver 0.14.1 on x86_64 macOS 14.1.2
2. Start serve daemon: cua-driver serve --autostart
3. Attempt a pixel-coordinate click on any window: echo '{"pid":<PID>,"window_id":<WID>,"x":200,"y":57}' | cua-driver click
4. Daemon crashes immediately with SIGSEGV

Reproduced 11 times in a single session, 100% reproducible.

Environment

• macOS: 14.1.2 (23B92) Sonoma
• Architecture: x86_64 (Intel Core i7-1068NG7)
• Model: MacBookPro16,2
• cua-driver: 0.14.1 (universal binary, running x86_64 slice)
• Binary: /Users/fengyaojie/.local/bin/cua-driver (universal: x86_64 + arm64)
• CuaDriver.app: /Applications/CuaDriver.app (universal: x86_64 + arm64)

Difference from #1503

	#1503 (fixed)	This issue
Exception	NSInvalidArgumentException	EXC_BAD_ACCESS / SIGSEGV
Crash point	messageWithEventRecord:pid:version: (ObjC selector)	SLSEventAuthenticationMessageCreateData (C function)
Architecture	arm64 (M1 Pro)	x86_64 (Intel)
macOS	14.8.7	14.1.2
Fix	class_respondsToSelector guard	❌ Not covered by that guard

Suggested Fix

The activate_without_raise path should be guarded at the SLSEventAuthenticationMessageCreateData call site (or higher at SLPSPostEventRecordTo) on macOS 14 x86_64, falling back to CGEventPostToPid without the auth envelope — similar to the graceful degradation already implemented for the ObjC selector path.

Alternatively, check macOS version + architecture before calling the SkyLight auth-message path, since this C function appears to have a null-pointer bug on x86_64 Sonoma.

Workaround

• capture and set_value (AX operations) work fine in background mode
• click via AXPress works for native AppKit controls
• Pixel-coordinate click and type via CGEvent crash the daemon
• Foreground typeE foreground type (keystrokes) works but briefly steals focus