The easiest thing that occurs to me would be a on-phone "message virus scanner" that self-updates and checks incoming messages against a threat database after d

The easiest thing that occurs to me would be a on-phone "message virus scanner" that self-updates and checks incoming messages against a threat database after decryption, but before passing them to the rest of the system. Architecture-wise some thought should be given to keeping iOS from being DoS'd by the crash/respawn of any service. Also, looking at the "assuming it's a string" line from the problem description, Apple needs to make an investment look through the codebase for this same error in other guises. That's what occurs to me off the top of my head anyway.