Macho segment bug #1272
Merged
Macho segment bug #1272
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
The current Mach-O parsing code attempts to call macho_rva_to_offset while parsing load commands and before it has set number_of_segments. Since macho_rva_to_offset uses number_of_segments this can result in it using a number_of_segments that is uninitialized and is just a random large number. In turn yara runs a really long time. This adds a test binary based on this post https://codegolf.stackexchange.com/questions/102471/smallest-possible-runnable-mach-o-executable/154685#154685 It has two load commands. The first is a LC_UNIXTHREAD command and the second is a LC_SEGMENT command. It's a valid 386 Mach-O binary. It reproduces this error.
plusvic
approved these changes
May 11, 2020
This was referenced May 18, 2020
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
See #1263
This PR updates the previous PR on top of the latest merged Mach-O parsing changes.
This also includes a test case for the bug condition.