Mach-O: allow 256 ncmds and 32768 sizeofcmds
https://github.com/upx/upx/issues/642 modified: p_mach.cpp modified: stub/src/i386-darwin.macho-upxmain.c modified: stub/src/powerpc-darwin.macho-upxmain.c
This commit is contained in:
committed by
Markus F.X.J. Oberhumer
parent
e56b748435
commit
01a30752c7
+3
-3
@@ -1515,7 +1515,7 @@ void PackMachBase<T>::unpack(OutputFile *fo)
|
|||||||
|| mhdri.filetype != mhdr->filetype)
|
|| mhdri.filetype != mhdr->filetype)
|
||||||
throwCantUnpack("file header corrupted");
|
throwCantUnpack("file header corrupted");
|
||||||
unsigned const ncmds = mhdr->ncmds;
|
unsigned const ncmds = mhdr->ncmds;
|
||||||
if (!ncmds || 24 < ncmds) { // arbitrary limit
|
if (!ncmds || 256 < ncmds) { // arbitrary limit
|
||||||
char msg[40]; snprintf(msg, sizeof(msg),
|
char msg[40]; snprintf(msg, sizeof(msg),
|
||||||
"bad Mach_header.ncmds = %d", ncmds);
|
"bad Mach_header.ncmds = %d", ncmds);
|
||||||
throwCantUnpack(msg);
|
throwCantUnpack(msg);
|
||||||
@@ -1946,8 +1946,8 @@ bool PackMachBase<T>::canPack()
|
|||||||
throwCantPack(buf);
|
throwCantPack(buf);
|
||||||
}
|
}
|
||||||
if (!sz_mhcmds
|
if (!sz_mhcmds
|
||||||
|| 16384 < sz_mhcmds) { // somewhat arbitrary, but amd64-darwin.macho-upxmain.c
|
|| 32768 < sz_mhcmds) { // somewhat arbitrary, but *-darwin.macho-upxmain.c
|
||||||
throwCantPack("16384 < Mach_header.sizeofcmds (or ==0)");
|
throwCantPack("32768 < Mach_header.sizeofcmds (or ==0)");
|
||||||
}
|
}
|
||||||
rawmseg_buf.alloc(sz_mhcmds);
|
rawmseg_buf.alloc(sz_mhcmds);
|
||||||
rawmseg = (Mach_segment_command *)(void *)rawmseg_buf;
|
rawmseg = (Mach_segment_command *)(void *)rawmseg_buf;
|
||||||
|
|||||||
@@ -776,7 +776,7 @@ main(int argc, char *argv[])
|
|||||||
break;
|
break;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
char mhdr[16384];
|
char mhdr[32768];
|
||||||
uint32_t entry = upx_main((struct l_info const *)payload, paysize,
|
uint32_t entry = upx_main((struct l_info const *)payload, paysize,
|
||||||
(Mach_header *)mhdr, sizeof(mhdr),
|
(Mach_header *)mhdr, sizeof(mhdr),
|
||||||
f_exp, f_unf, (Mach_header **)&argv[-2]);
|
f_exp, f_unf, (Mach_header **)&argv[-2]);
|
||||||
|
|||||||
@@ -733,7 +733,7 @@ main(int argc, char *argv[])
|
|||||||
break;
|
break;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
char mhdr[16384];
|
char mhdr[32768];
|
||||||
uint32_t entry = upx_main((struct l_info const *)payload, paysize,
|
uint32_t entry = upx_main((struct l_info const *)payload, paysize,
|
||||||
(Mach_header *)mhdr, sizeof(mhdr),
|
(Mach_header *)mhdr, sizeof(mhdr),
|
||||||
f_exp, f_unf, (Mach_header **)&argv[-2]);
|
f_exp, f_unf, (Mach_header **)&argv[-2]);
|
||||||
|
|||||||
Reference in New Issue
Block a user