Extend rbran's parser robustness fixes with file-backed bounds and configurable limits (#8303)

Improve Mach-O parsing robustness and memory safety by tightening bounds checks, correctly accounting for fat-binary slice offsets, and avoiding empty-vector access. Rework the rebase/bind entry limit to derive from slice and pointer size, and centralize budget enforcement so all relocation opcodes are consistently bounded. Also simplify several reads, naming, and redundant exception handling.

Co-authored-by: rbran <git@rubens.io>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: 3 people

binaryview.cpp

@@ -1384,15 +1384,39 @@ BinaryView::BinaryView(BNBinaryView* view)
 
 bool BinaryView::InitCallback(void* ctxt)
 {
-	CallbackRef<BinaryView> view(ctxt);
-	return view->Init();
+	try
+	{
+		CallbackRef<BinaryView> view(ctxt);
+		return view->Init();
+	}
+	catch (const std::exception& e)
+	{
+		LogError("BinaryView::Init failed: %s", e.what());
+		return false;
+	}
+	catch (...)
+	{
+		LogError("BinaryView::Init failed with unknown exception");
+		return false;
+	}
 }
 
 
 void BinaryView::OnAfterSnapshotDataAppliedCallback(void* ctxt)
 {
-	CallbackRef<BinaryView> view(ctxt);
-	view->OnAfterSnapshotDataApplied();
+	try
+	{
+		CallbackRef<BinaryView> view(ctxt);
+		view->OnAfterSnapshotDataApplied();
+	}
+	catch (const std::exception& e)
+	{
+		LogError("BinaryView::OnAfterSnapshotDataApplied failed: %s", e.what());
+	}
+	catch (...)
+	{
+		LogError("BinaryView::OnAfterSnapshotDataApplied failed with unknown exception");
+	}
 }
 
 
@@ -1531,9 +1555,22 @@ size_t BinaryView::GetAddressSizeCallback(void* ctxt)
 
 bool BinaryView::SaveCallback(void* ctxt, BNFileAccessor* file)
 {
-	CallbackRef<BinaryView> view(ctxt);
-	CoreFileAccessor accessor(file);
-	return view->PerformSave(&accessor);
+	try
+	{
+		CallbackRef<BinaryView> view(ctxt);
+		CoreFileAccessor accessor(file);
+		return view->PerformSave(&accessor);
+	}
+	catch (const std::exception& e)
+	{
+		LogError("BinaryView::Save failed: %s", e.what());
+		return false;
+	}
+	catch (...)
+	{
+		LogError("BinaryView::Save failed with unknown exception");
+		return false;
+	}
 }
 
 

view/macho/chained_fixups.cpp

@@ -240,12 +240,21 @@ auto FixupReaderForFormat(int format) -> std::pair<uint64_t, FixupInfo>(*)(Binar
 	throw std::invalid_argument("Unknown chained pointer format: " + std::to_string(format));
 }
 
+// Returns the NUL-terminated string starting at `offset` within `symbolData`, or an
+// empty view if `offset` does not fall within `symbolData`.
+std::string_view SymbolNameAt(std::span<const char> symbolData, uint32_t offset)
+{
+	if (symbolData.size() <= offset)
+		return std::string_view();
+	return std::string_view(&symbolData[offset], strnlen(&symbolData[offset], symbolData.size() - offset));
+}
+
 ImportEntry ReadChainedImport32(BinaryReader& reader, std::span<const char> symbolData)
 {
 	dyld_chained_import import;
 	reader.Read(&import, sizeof(import));
 	return {
-		std::string_view(&symbolData[import.name_offset]),
+		SymbolNameAt(symbolData, import.name_offset),
 		0,
 		import.lib_ordinal > 0xF0 ? static_cast<int8_t>(import.lib_ordinal) : static_cast<int32_t>(import.lib_ordinal),
 		(bool)import.weak_import,
@@ -257,7 +266,7 @@ ImportEntry ReadChainedImportAddend32(BinaryReader& reader, std::span<const char
 	dyld_chained_import_addend import;
 	reader.Read(&import, sizeof(import));
 	return {
-		std::string_view(&symbolData[import.name_offset]),
+		SymbolNameAt(symbolData, import.name_offset),
 		static_cast<uint32_t>(import.addend),
 		import.lib_ordinal > 0xF0 ? static_cast<int8_t>(import.lib_ordinal) : static_cast<int32_t>(import.lib_ordinal),
 		(bool)import.weak_import,
@@ -269,7 +278,7 @@ ImportEntry ReadChainedImportAddend64(BinaryReader& reader, std::span<const char
 	dyld_chained_import_addend64 import;
 	reader.Read(&import, sizeof(import));
 	return {
-		std::string_view(&symbolData[import.name_offset]),
+		SymbolNameAt(symbolData, import.name_offset),
 		import.addend,
 		import.lib_ordinal > 0xFFF0 ? static_cast<int16_t>(import.lib_ordinal) : static_cast<int32_t>(import.lib_ordinal),
 		(bool)import.weak_import,
@@ -304,6 +313,8 @@ std::vector<ImportEntry> ChainedFixupProcessor::ProcessImports() const
 
 	auto header = ReadHeader(reader);
 
+	if (header.symbols_offset >= m_fixupsSize)
+		return imports;
 	uint64_t symbolDataSize = m_fixupsSize - header.symbols_offset;
 	m_symbolData.resize(symbolDataSize);
 	m_raw->Read(&m_symbolData[0], OffsetInFixups(header.symbols_offset), symbolDataSize);
@@ -435,7 +446,7 @@ void ChainedFixupProcessor::ProcessChainsInSegment(const dyld_chained_starts_in_
 
 		bool done = false;
 		while (!done)
-		{ 
+		{
 			uint64_t position = reader.GetOffset();
 			auto [raw, fixupInfo] = fixupReader(reader);