jory/upx
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Fix thinko in PackMachBase<T>::canUnpack(). Also detect more bad input values.

Browse Source 
https://github.com/upx/upx/issues/109
	modified:   p_mach.cpp
This commit is contained in:
John Reiser
2017-06-18 14:24:44 -07:00
parent b2115a4162
commit 650df95b72
1 changed files with 13 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/p_mach.cpp
+12 -2
View File
@@ -1639,6 +1639,10 @@ int PackMachBase<T>::canUnpack()
return false; return false;
my_cpusubtype = mhdri.cpusubtype; my_cpusubtype = mhdri.cpusubtype;
int headway = (int)mhdri.sizeofcmds;
if (1024 < headway) {
infoWarning("Mach_header.sizeofcmds(%d) > 1024", headway);
}
rawmseg = (Mach_segment_command *)new char[(unsigned) mhdri.sizeofcmds]; rawmseg = (Mach_segment_command *)new char[(unsigned) mhdri.sizeofcmds];
fi->readx(rawmseg, mhdri.sizeofcmds); fi->readx(rawmseg, mhdri.sizeofcmds);
@@ -1674,6 +1678,12 @@ int PackMachBase<T>::canUnpack()
} }
} }
pos_next = segptr->filesize + segptr->fileoff; pos_next = segptr->filesize + segptr->fileoff;
if ((headway -= ptr->cmdsize) < 0) {
infoWarning("Mach_command[%u]{@%lu}.cmdsize = %u", j,
sizeof(mhdri) + mhdri.sizeofcmds - (headway + ptr->cmdsize),
(unsigned)ptr->cmdsize);
throwCantUnpack("sum(.cmdsize) exceeds .sizeofcmds");
}
} }
else if (Mach_command::LC_UNIXTHREAD==ptr->cmd) { else if (Mach_command::LC_UNIXTHREAD==ptr->cmd) {
rip = entryVMA = threadc_getPC(ptr); rip = entryVMA = threadc_getPC(ptr);
@@ -1784,8 +1794,8 @@ int PackMachBase<T>::canUnpack()
for (p = (unsigned const *)&buf[0x1000]; p > lo; ) if (*--p) { for (p = (unsigned const *)&buf[0x1000]; p > lo; ) if (*--p) {
overlay_offset = *(TE32 const *)p; overlay_offset = *(TE32 const *)p;
if ((off_t)overlay_offset < offLINK) { if ((off_t)overlay_offset < offLINK) {
overlay_offset -= (char const *)p - (char const *)lo overlay_offset = ((char const *)p - (char const *)lo) +
+ (offLINK - 0x1000) - sizeof(l_info); (offLINK - 0x1000) - overlay_offset + sizeof(l_info);
fi->seek(overlay_offset, SEEK_SET); fi->seek(overlay_offset, SEEK_SET);
fi->readx(buf, bufsize); fi->readx(buf, bufsize);
if (b_ptr->sz_unc < 0x4000 if (b_ptr->sz_unc < 0x4000