Files
upx/src/stub/tmp/amd64-darwin.dylib-entry.bin.dump
T
John Reiser 65b06f6046 More LZMA inSize (srclen) defense
https://github.com/upx/upx/issues/717

	modified:   stub/src/amd64-darwin.dylib-entry.S  fixed
	modified:   stub/src/amd64-darwin.macho-entry.S  fixed
	modified:   stub/src/amd64-linux.elf-so_entry.S  comment-only
	modified:   stub/src/i386-linux.elf-so_entry.S  comment-only

	modified:   stub/amd64-darwin.dylib-entry.h
	modified:   stub/amd64-darwin.macho-entry.h
	modified:   stub/amd64-linux.elf-so_entry.h
	modified:   stub/tmp/amd64-darwin.dylib-entry.bin.dump
	modified:   stub/tmp/amd64-darwin.macho-entry.bin.dump
	modified:   stub/tmp/amd64-linux.elf-so_entry.bin.dump

Find+fix steps that were performed:
1. Find all 'add' instructions that compute "eof".
NRV run-time decompressors ignore srclen, so 'add' can be ignored for them.

$ cd upx-devel4/src/stub
$ grep -sr 'add.*eof' src  |  grep -v 'nrv2._d.*.S'  |  sort
src/amd64-darwin.dylib-entry.S:        addq src,lsrc; push lsrc  // &input_eof
src/amd64-darwin.macho-entry.S:        addq src,lsrc; push lsrc  // &input_eof
src/amd64-linux.elf-entry.S:        addq src,lsrc; push lsrc  // &input_eof
src/amd64-linux.elf-so_entry.S:        addq src,lsrc; push lsrc  // MATCH_05  &input_eof
src/amd64-linux.elf-so_main.c:            void *mfd_addr = Pmap(0, sizeof(code), PROT_READ|PROT_EXEC, MAP_PRIVATE, mfd, 0);
src/amd64-linux.shlib-init.S:        addq src,lsrc; push lsrc  // &input_eof
src/arch/amd64/lzma_d.S://      addq src,lsrc; push lsrc  // &input_eof
src/i386-expand.S:    add src,%ecx; push %ecx  // MATCH_52  eof_src
src/i386-linux.elf-so_entry.S:        add src,lsrc; push lsrc  // MATCH_05  &input_eof

2.  Case-by-case inspection

src/amd64-darwin.dylib-entry.S:        addq src,lsrc; push lsrc  // &input_eof
    restoring 'subq' is added in this commit

src/amd64-darwin.macho-entry.S:        addq src,lsrc; push lsrc  // &input_eof
    restoring 'subq' is added in this commit

src/amd64-linux.elf-entry.S:        addq src,lsrc; push lsrc  // &input_eof
    a restoring 'subq' is already next

src/amd64-linux.elf-so_entry.S:        addq src,lsrc; push lsrc  // MATCH_05  &input_eof
    lsrc is dead for inlined nrv2b

src/amd64-linux.elf-so_main.c:            void *mfd_addr = Pmap(0, sizeof(code), PROT_READ|PROT_EXEC, MAP_PRIVATE, mfd, 0);
    .c code

src/amd64-linux.shlib-init.S:        addq src,lsrc; push lsrc  // &input_eof
    restoring 'subq' is already next

src/arch/amd64/lzma_d.S://      addq src,lsrc; push lsrc  // &input_eof
    comment that explains preceding actions in ELFMAINX; a restoring 'subq' is already next

src/i386-expand.S:    add src,%ecx; push %ecx  // MATCH_52  eof_src
    %ecx is dead

src/i386-linux.elf-so_entry.S:        add src,lsrc; push lsrc  // MATCH_05  &input_eof
    lsrc is dead for inlined nrv2b
2023-10-12 10:41:13 -07:00

59 lines
2.4 KiB
Plaintext
Vendored
Generated

file format elf64-x86-64
Sections:
Idx Name Size VMA LMA File off Algn Flags
0 MACHMAINX 020 0 0 040 2**0 CONTENTS
1 NRV_HEAD 066 0 0 060 2**0 CONTENTS
2 NRV2E 0ba 0 0 0c6 2**0 CONTENTS
3 NRV2D 0a1 0 0 0180 2**0 CONTENTS
4 NRV2B 093 0 0 0221 2**0 CONTENTS
5 LZMA_ELF00 064 0 0 02b4 2**0 CONTENTS
6 LZMA_DEC10 09f7 0 0 0318 2**0 CONTENTS
7 LZMA_DEC20 09f7 0 0 0d0f 2**0 CONTENTS
8 LZMA_DEC30 018 0 0 01706 2**0 CONTENTS
9 NRV_TAIL 0 0 0 0171e 2**0 CONTENTS
10 MACHMAINY 011 0 0 0171e 2**0 CONTENTS
11 MACHMAINZ 0148 0 0 0172f 2**0 CONTENTS
SYMBOL TABLE:
0000000000000000 l d NRV_HEAD 0 NRV_HEAD
0000000000000000 l d LZMA_DEC30 0 LZMA_DEC30
0000000000000000 l d MACHMAINY 0 MACHMAINY
0000000000000000 l d MACHMAINZ 0 MACHMAINZ
0000000000000000 l d MACHMAINX 0 MACHMAINX
0000000000000000 l d NRV2E 0 NRV2E
0000000000000000 l d NRV2D 0 NRV2D
0000000000000000 l d NRV2B 0 NRV2B
0000000000000000 l d LZMA_ELF00 0 LZMA_ELF00
0000000000000000 l d LZMA_DEC10 0 LZMA_DEC10
0000000000000000 l d LZMA_DEC20 0 LZMA_DEC20
0000000000000000 l d NRV_TAIL 0 NRV_TAIL
0000000000000000 g MACHMAINX 0 _start
0000000000000011 g MACHMAINY 0 end_decompress
RELOCATION RECORDS FOR [MACHMAINX]:
OFFSET TYPE VALUE
000000000000000a R_X86_64_PC32 MACHMAINZ+0xfffffffffffffffc
RELOCATION RECORDS FOR [NRV2E]:
OFFSET TYPE VALUE
00000000000000af R_X86_64_PC32 NRV_HEAD+0x0000000000000021
000000000000005c R_X86_64_PC32 MACHMAINY+0xfffffffffffffffc
RELOCATION RECORDS FOR [NRV2D]:
OFFSET TYPE VALUE
0000000000000096 R_X86_64_PC32 NRV_HEAD+0x0000000000000021
000000000000005c R_X86_64_PC32 MACHMAINY+0xfffffffffffffffc
RELOCATION RECORDS FOR [NRV2B]:
OFFSET TYPE VALUE
000000000000008b R_X86_64_PC32 NRV_HEAD+0x0000000000000021
0000000000000053 R_X86_64_PC32 MACHMAINY+0xfffffffffffffffc
RELOCATION RECORDS FOR [LZMA_ELF00]:
OFFSET TYPE VALUE
0000000000000006 R_X86_64_PC32 LZMA_DEC30+0x0000000000000012
RELOCATION RECORDS FOR [MACHMAINZ]:
OFFSET TYPE VALUE
000000000000001c R_X86_64_32 MACHMAINZ+0x000000000000014c