Skip to content

Commit ffcf00e

Browse files
committed
[Objective-C] Fix misc crashes for bad input binaries
Fixes Vector35/binaryninja#1470
1 parent 6ab0d3d commit ffcf00e

1 file changed

Lines changed: 12 additions & 0 deletions

File tree

objectivec/objc.cpp

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -847,6 +847,11 @@ void ObjCProcessor::LoadProtocols(ObjCReader* reader, Ref<Section> listSection)
847847
"protoProtocols_" + protocolName, protocol.protocols, true);
848848
reader->Seek(protocol.protocols);
849849
uint32_t count = reader->Read64();
850+
if (count > 0x1000)
851+
{
852+
m_logger->LogWarn("List of protocols at 0x%llx has too large a count of 0x%x, skipping...", protocol.protocols, count);
853+
continue;
854+
}
850855
view_ptr_t addr = reader->GetOffset();
851856
for (uint32_t j = 0; j < count; j++)
852857
{
@@ -1066,6 +1071,11 @@ void ObjCProcessor::ReadIvarList(ObjCReader* reader, ClassBase& cls, std::string
10661071
ivar_list_t head;
10671072
head.entsizeAndFlags = reader->Read32();
10681073
head.count = reader->Read32();
1074+
if (head.count > 0x1000)
1075+
{
1076+
m_logger->LogWarn("Ivar list at 0x%llx has an invalid count of 0x%x, skipping..", start, head.count);
1077+
return;
1078+
}
10691079
auto addressSize = m_data->GetAddressSize();
10701080
DefineObjCSymbol(DataSymbol, m_typeNames.ivarList, "ivar_list_" + std::string(name), start, true);
10711081
for (unsigned i = 0; i < head.count; i++)
@@ -1681,6 +1691,8 @@ void ObjCProcessor::ProcessCFStrings()
16811691
uint64_t flags = reader->ReadPointer();
16821692
auto strLoc = ReadPointerAccountingForRelocations(reader.get());
16831693
auto size = reader->ReadPointer();
1694+
if (size > 0x10000)
1695+
continue;
16841696
std::string str;
16851697
if (flags & 0b10000) // UTF16
16861698
{

0 commit comments

Comments
 (0)