jory/upx
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

More LZMA inSize (srclen) defense

Browse Source 
https://github.com/upx/upx/issues/717

	modified:   stub/src/amd64-darwin.dylib-entry.S  fixed
	modified:   stub/src/amd64-darwin.macho-entry.S  fixed
	modified:   stub/src/amd64-linux.elf-so_entry.S  comment-only
	modified:   stub/src/i386-linux.elf-so_entry.S  comment-only

	modified:   stub/amd64-darwin.dylib-entry.h
	modified:   stub/amd64-darwin.macho-entry.h
	modified:   stub/amd64-linux.elf-so_entry.h
	modified:   stub/tmp/amd64-darwin.dylib-entry.bin.dump
	modified:   stub/tmp/amd64-darwin.macho-entry.bin.dump
	modified:   stub/tmp/amd64-linux.elf-so_entry.bin.dump

Find+fix steps that were performed:
1. Find all 'add' instructions that compute "eof".
NRV run-time decompressors ignore srclen, so 'add' can be ignored for them.

$ cd upx-devel4/src/stub
$ grep -sr 'add.*eof' src  |  grep -v 'nrv2._d.*.S'  |  sort
src/amd64-darwin.dylib-entry.S:        addq src,lsrc; push lsrc  // &input_eof
src/amd64-darwin.macho-entry.S:        addq src,lsrc; push lsrc  // &input_eof
src/amd64-linux.elf-entry.S:        addq src,lsrc; push lsrc  // &input_eof
src/amd64-linux.elf-so_entry.S:        addq src,lsrc; push lsrc  // MATCH_05  &input_eof
src/amd64-linux.elf-so_main.c:            void *mfd_addr = Pmap(0, sizeof(code), PROT_READ|PROT_EXEC, MAP_PRIVATE, mfd, 0);
src/amd64-linux.shlib-init.S:        addq src,lsrc; push lsrc  // &input_eof
src/arch/amd64/lzma_d.S://      addq src,lsrc; push lsrc  // &input_eof
src/i386-expand.S:    add src,%ecx; push %ecx  // MATCH_52  eof_src
src/i386-linux.elf-so_entry.S:        add src,lsrc; push lsrc  // MATCH_05  &input_eof

2.  Case-by-case inspection

src/amd64-darwin.dylib-entry.S:        addq src,lsrc; push lsrc  // &input_eof
    restoring 'subq' is added in this commit

src/amd64-darwin.macho-entry.S:        addq src,lsrc; push lsrc  // &input_eof
    restoring 'subq' is added in this commit

src/amd64-linux.elf-entry.S:        addq src,lsrc; push lsrc  // &input_eof
    a restoring 'subq' is already next

src/amd64-linux.elf-so_entry.S:        addq src,lsrc; push lsrc  // MATCH_05  &input_eof
    lsrc is dead for inlined nrv2b

src/amd64-linux.elf-so_main.c:            void *mfd_addr = Pmap(0, sizeof(code), PROT_READ|PROT_EXEC, MAP_PRIVATE, mfd, 0);
    .c code

src/amd64-linux.shlib-init.S:        addq src,lsrc; push lsrc  // &input_eof
    restoring 'subq' is already next

src/arch/amd64/lzma_d.S://      addq src,lsrc; push lsrc  // &input_eof
    comment that explains preceding actions in ELFMAINX; a restoring 'subq' is already next

src/i386-expand.S:    add src,%ecx; push %ecx  // MATCH_52  eof_src
    %ecx is dead

src/i386-linux.elf-so_entry.S:        add src,lsrc; push lsrc  // MATCH_05  &input_eof
    lsrc is dead for inlined nrv2b
This commit is contained in:
John Reiser
2023-10-12 10:41:13 -07:00
committed by Markus F.X.J. Oberhumer
parent 0515be4334
commit 65b06f6046
10 changed files with 1185 additions and 1181 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/stub/tmp/amd64-darwin.dylib-entry.bin.dump
Generated Vendored
+12 -12
View File
@@ -2,18 +2,18 @@ file format elf64-x86-64
Sections:
Idx Name Size VMA LMA File off Algn Flags
0 MACHMAINX 01d 0 0 040 2**0 CONTENTS
1 NRV_HEAD 066 0 0 05d 2**0 CONTENTS
2 NRV2E 0ba 0 0 0c3 2**0 CONTENTS
3 NRV2D 0a1 0 0 017d 2**0 CONTENTS
4 NRV2B 093 0 0 021e 2**0 CONTENTS
5 LZMA_ELF00 064 0 0 02b1 2**0 CONTENTS
6 LZMA_DEC10 09f7 0 0 0315 2**0 CONTENTS
7 LZMA_DEC20 09f7 0 0 0d0c 2**0 CONTENTS
8 LZMA_DEC30 018 0 0 01703 2**0 CONTENTS
9 NRV_TAIL 0 0 0 0171b 2**0 CONTENTS
10 MACHMAINY 011 0 0 0171b 2**0 CONTENTS
11 MACHMAINZ 0148 0 0 0172c 2**0 CONTENTS
0 MACHMAINX 020 0 0 040 2**0 CONTENTS
1 NRV_HEAD 066 0 0 060 2**0 CONTENTS
2 NRV2E 0ba 0 0 0c6 2**0 CONTENTS
3 NRV2D 0a1 0 0 0180 2**0 CONTENTS
4 NRV2B 093 0 0 0221 2**0 CONTENTS
5 LZMA_ELF00 064 0 0 02b4 2**0 CONTENTS
6 LZMA_DEC10 09f7 0 0 0318 2**0 CONTENTS
7 LZMA_DEC20 09f7 0 0 0d0f 2**0 CONTENTS
8 LZMA_DEC30 018 0 0 01706 2**0 CONTENTS
9 NRV_TAIL 0 0 0 0171e 2**0 CONTENTS
10 MACHMAINY 011 0 0 0171e 2**0 CONTENTS
11 MACHMAINZ 0148 0 0 0172f 2**0 CONTENTS
SYMBOL TABLE:
0000000000000000 l d NRV_HEAD 0 NRV_HEAD
0000000000000000 l d LZMA_DEC30 0 LZMA_DEC30