From cc945e41a7788327d0e8ba0ea6dc3571d7efa04f Mon Sep 17 00:00:00 2001 From: Cyndy Ishida Date: Tue, 9 Jul 2024 10:18:05 -0700 Subject: [MachO] Loosen boundary check for reading export trie nodes (#96705) The design of the export trie in macho's is that each node has a variable length payload. When reading nodes, it should be an error if reading the uleb128 puts you beyond the stated node size but not when the stated size goes beyond the known part that was read. resolves: rdar://130310832 This was primarily authored by Nick Kledzik, I added/cleaned up the test cases. --- llvm/lib/Object/MachOObjectFile.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'llvm/lib/Object/MachOObjectFile.cpp') diff --git a/llvm/lib/Object/MachOObjectFile.cpp b/llvm/lib/Object/MachOObjectFile.cpp index 61d880b..812b2c0 100644 --- a/llvm/lib/Object/MachOObjectFile.cpp +++ b/llvm/lib/Object/MachOObjectFile.cpp @@ -3104,7 +3104,7 @@ void ExportEntry::pushNode(uint64_t offset) { } } } - if(ExportStart + ExportInfoSize != State.Current) { + if (ExportStart + ExportInfoSize < State.Current) { *E = malformedError( "inconsistent export info size: 0x" + Twine::utohexstr(ExportInfoSize) + " where actual size was: 0x" + -- cgit v1.1