Skip to content

Commit 4a33dcc

Browse files
Weitao-Sunclaude
andcommitted
Fix potential underflow in MachoView::ParseSymbolTable string bounds check
The existing guard compared sym.n_strx against symtab.strsize, but the string list buffer is filled by Read() which may return fewer bytes than requested on a truncated file. When the buffer is shorter than strsize, an n_strx value that passes the strsize check can still exceed the actual buffer length, causing the strnlen length argument to underflow and read past the end of the buffer. Replacing the check with a comparison against stringList.GetLength() ensures the subtraction always stays in bounds. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
1 parent 5a9bde9 commit 4a33dcc

1 file changed

Lines changed: 4 additions & 1 deletion

File tree

view/macho/machoview.cpp

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3382,7 +3382,10 @@ void MachoView::ParseSymbolTable(BinaryReader& reader, MachOHeader& header, cons
33823382
sym.n_value = (m_addressSize == 4) ? reader.Read32() : reader.Read64();
33833383
if (sym.n_value)
33843384
sym.n_value += m_imageBaseAdjustment;
3385-
if (sym.n_strx >= symtab.strsize || ((sym.n_type & N_TYPE) == N_INDR))
3385+
// Use GetLength() rather than symtab.strsize because Read() may return
3386+
// fewer bytes than requested; checking strsize would allow n_strx to pass
3387+
// while still being past the end of the actual buffer.
3388+
if (sym.n_strx >= header.stringList.GetLength() || ((sym.n_type & N_TYPE) == N_INDR))
33863389
continue;
33873390

33883391
const char* symbolName = (const char*)header.stringList.GetDataAt(sym.n_strx);

0 commit comments

Comments
 (0)