 John Reiser
|
65b06f6046
|
More LZMA inSize (srclen) defense
https://github.com/upx/upx/issues/717
modified: stub/src/amd64-darwin.dylib-entry.S fixed
modified: stub/src/amd64-darwin.macho-entry.S fixed
modified: stub/src/amd64-linux.elf-so_entry.S comment-only
modified: stub/src/i386-linux.elf-so_entry.S comment-only
modified: stub/amd64-darwin.dylib-entry.h
modified: stub/amd64-darwin.macho-entry.h
modified: stub/amd64-linux.elf-so_entry.h
modified: stub/tmp/amd64-darwin.dylib-entry.bin.dump
modified: stub/tmp/amd64-darwin.macho-entry.bin.dump
modified: stub/tmp/amd64-linux.elf-so_entry.bin.dump
Find+fix steps that were performed:
1. Find all 'add' instructions that compute "eof".
NRV run-time decompressors ignore srclen, so 'add' can be ignored for them.
$ cd upx-devel4/src/stub
$ grep -sr 'add.*eof' src | grep -v 'nrv2._d.*.S' | sort
src/amd64-darwin.dylib-entry.S: addq src,lsrc; push lsrc // &input_eof
src/amd64-darwin.macho-entry.S: addq src,lsrc; push lsrc // &input_eof
src/amd64-linux.elf-entry.S: addq src,lsrc; push lsrc // &input_eof
src/amd64-linux.elf-so_entry.S: addq src,lsrc; push lsrc // MATCH_05 &input_eof
src/amd64-linux.elf-so_main.c: void *mfd_addr = Pmap(0, sizeof(code), PROT_READ|PROT_EXEC, MAP_PRIVATE, mfd, 0);
src/amd64-linux.shlib-init.S: addq src,lsrc; push lsrc // &input_eof
src/arch/amd64/lzma_d.S:// addq src,lsrc; push lsrc // &input_eof
src/i386-expand.S: add src,%ecx; push %ecx // MATCH_52 eof_src
src/i386-linux.elf-so_entry.S: add src,lsrc; push lsrc // MATCH_05 &input_eof
2. Case-by-case inspection
src/amd64-darwin.dylib-entry.S: addq src,lsrc; push lsrc // &input_eof
restoring 'subq' is added in this commit
src/amd64-darwin.macho-entry.S: addq src,lsrc; push lsrc // &input_eof
restoring 'subq' is added in this commit
src/amd64-linux.elf-entry.S: addq src,lsrc; push lsrc // &input_eof
a restoring 'subq' is already next
src/amd64-linux.elf-so_entry.S: addq src,lsrc; push lsrc // MATCH_05 &input_eof
lsrc is dead for inlined nrv2b
src/amd64-linux.elf-so_main.c: void *mfd_addr = Pmap(0, sizeof(code), PROT_READ|PROT_EXEC, MAP_PRIVATE, mfd, 0);
.c code
src/amd64-linux.shlib-init.S: addq src,lsrc; push lsrc // &input_eof
restoring 'subq' is already next
src/arch/amd64/lzma_d.S:// addq src,lsrc; push lsrc // &input_eof
comment that explains preceding actions in ELFMAINX; a restoring 'subq' is already next
src/i386-expand.S: add src,%ecx; push %ecx // MATCH_52 eof_src
%ecx is dead
src/i386-linux.elf-so_entry.S: add src,lsrc; push lsrc // MATCH_05 &input_eof
lsrc is dead for inlined nrv2b
|
2023-10-12 10:41:13 -07:00 |
|
|
John Reiser
|
56bb7b53cb
|
Synch *.h stub headers and testcase checksums
Shared libraries for amd64, i386, arm64, and arm should be
compatible with SELinux: no complaints of execmod or execmem.
https://github.com/upx/upx/issues/609
https://github.com/upx/upx/issues/220
modified: ../.github/travis_testsuite_1-expected_sha256sums.sh
modified: stub/amd64-linux.elf-so_entry.h
modified: stub/amd64-linux.elf-so_fold.h
modified: stub/arm.v4a-linux.elf-so_entry.h
modified: stub/arm.v4a-linux.elf-so_fold.h
modified: stub/arm.v5a-linux.elf-entry.h
modified: stub/arm.v5a-linux.elf-fold.h
modified: stub/arm.v5a-linux.elf-so_entry.h
modified: stub/arm.v5a-linux.elf-so_fold.h
modified: stub/arm64-linux.elf-so_entry.h
modified: stub/arm64-linux.elf-so_fold.h
modified: stub/i386-linux.elf-so_entry.h
modified: stub/i386-linux.elf-so_fold.h
modified: stub/tmp/amd64-linux.elf-so_entry.bin.dump
modified: stub/tmp/amd64-linux.elf-so_fold.bin.dump
modified: stub/tmp/arm.v5a-linux.elf-entry.bin.dump
modified: stub/tmp/arm.v5a-linux.elf-fold.map
|
2023-04-30 15:12:29 -07:00 |
|