Skip to content

Commit 871c1a3

Browse files
Weitao-Sunclaude
andcommitted
Fix potential underflow in MachoView::ParseSymbolTable string bounds check
The existing guard compared sym.n_strx against symtab.strsize, but the string list buffer is filled by Read() which may return fewer bytes than requested on a truncated file. When the buffer is shorter than strsize, an n_strx value that passes the strsize check can still exceed the actual buffer length, causing the strnlen length argument to underflow and read past the end of the buffer. Replacing the check with a comparison against stringList.GetLength() ensures the subtraction always stays in bounds. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
1 parent 16a0342 commit 871c1a3

1 file changed

Lines changed: 4 additions & 1 deletion

File tree

view/macho/machoview.cpp

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3382,7 +3382,10 @@ void MachoView::ParseSymbolTable(BinaryReader& reader, MachOHeader& header, cons
33823382
sym.n_value = (m_addressSize == 4) ? reader.Read32() : reader.Read64();
33833383
if (sym.n_value)
33843384
sym.n_value += m_imageBaseAdjustment;
3385-
if (sym.n_strx >= symtab.strsize || ((sym.n_type & N_TYPE) == N_INDR))
3385+
// Use GetLength() rather than symtab.strsize because Read() may return
3386+
// fewer bytes than requested; checking strsize would allow n_strx to pass
3387+
// while still being past the end of the actual buffer.
3388+
if (sym.n_strx >= header.stringList.GetLength() || ((sym.n_type & N_TYPE) == N_INDR))
33863389
continue;
33873390

33883391
const char* symbolName = (const char*)header.stringList.GetDataAt(sym.n_strx);

0 commit comments

Comments
 (0)