jory/upx
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

More LZMA inSize (srclen) defense

Browse Source 
https://github.com/upx/upx/issues/717

	modified:   stub/src/amd64-darwin.dylib-entry.S  fixed
	modified:   stub/src/amd64-darwin.macho-entry.S  fixed
	modified:   stub/src/amd64-linux.elf-so_entry.S  comment-only
	modified:   stub/src/i386-linux.elf-so_entry.S  comment-only

	modified:   stub/amd64-darwin.dylib-entry.h
	modified:   stub/amd64-darwin.macho-entry.h
	modified:   stub/amd64-linux.elf-so_entry.h
	modified:   stub/tmp/amd64-darwin.dylib-entry.bin.dump
	modified:   stub/tmp/amd64-darwin.macho-entry.bin.dump
	modified:   stub/tmp/amd64-linux.elf-so_entry.bin.dump

Find+fix steps that were performed:
1. Find all 'add' instructions that compute "eof".
NRV run-time decompressors ignore srclen, so 'add' can be ignored for them.

$ cd upx-devel4/src/stub
$ grep -sr 'add.*eof' src  |  grep -v 'nrv2._d.*.S'  |  sort
src/amd64-darwin.dylib-entry.S:        addq src,lsrc; push lsrc  // &input_eof
src/amd64-darwin.macho-entry.S:        addq src,lsrc; push lsrc  // &input_eof
src/amd64-linux.elf-entry.S:        addq src,lsrc; push lsrc  // &input_eof
src/amd64-linux.elf-so_entry.S:        addq src,lsrc; push lsrc  // MATCH_05  &input_eof
src/amd64-linux.elf-so_main.c:            void *mfd_addr = Pmap(0, sizeof(code), PROT_READ|PROT_EXEC, MAP_PRIVATE, mfd, 0);
src/amd64-linux.shlib-init.S:        addq src,lsrc; push lsrc  // &input_eof
src/arch/amd64/lzma_d.S://      addq src,lsrc; push lsrc  // &input_eof
src/i386-expand.S:    add src,%ecx; push %ecx  // MATCH_52  eof_src
src/i386-linux.elf-so_entry.S:        add src,lsrc; push lsrc  // MATCH_05  &input_eof

2.  Case-by-case inspection

src/amd64-darwin.dylib-entry.S:        addq src,lsrc; push lsrc  // &input_eof
    restoring 'subq' is added in this commit

src/amd64-darwin.macho-entry.S:        addq src,lsrc; push lsrc  // &input_eof
    restoring 'subq' is added in this commit

src/amd64-linux.elf-entry.S:        addq src,lsrc; push lsrc  // &input_eof
    a restoring 'subq' is already next

src/amd64-linux.elf-so_entry.S:        addq src,lsrc; push lsrc  // MATCH_05  &input_eof
    lsrc is dead for inlined nrv2b

src/amd64-linux.elf-so_main.c:            void *mfd_addr = Pmap(0, sizeof(code), PROT_READ|PROT_EXEC, MAP_PRIVATE, mfd, 0);
    .c code

src/amd64-linux.shlib-init.S:        addq src,lsrc; push lsrc  // &input_eof
    restoring 'subq' is already next

src/arch/amd64/lzma_d.S://      addq src,lsrc; push lsrc  // &input_eof
    comment that explains preceding actions in ELFMAINX; a restoring 'subq' is already next

src/i386-expand.S:    add src,%ecx; push %ecx  // MATCH_52  eof_src
    %ecx is dead

src/i386-linux.elf-so_entry.S:        add src,lsrc; push lsrc  // MATCH_05  &input_eof
    lsrc is dead for inlined nrv2b
This commit is contained in:
John Reiser
2023-10-12 10:41:13 -07:00
committed by Markus F.X.J. Oberhumer
parent 0515be4334
commit 65b06f6046
10 changed files with 1185 additions and 1181 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/stub/amd64-darwin.macho-entry.h
Generated
+554 -553
View File
File diff suppressed because it is too large Load Diff