Skip to content

Account for excessive read limits in macho parsing#682

Merged
wagoodman merged 1 commit intomainfrom
fix-read-lengths
Mar 10, 2026
Merged

Account for excessive read limits in macho parsing#682
wagoodman merged 1 commit intomainfrom
fix-read-lengths

Conversation

@wagoodman
Copy link
Copy Markdown
Contributor

Adds validation for size fields read from untrusted Mach-O binaries before allocating memory. A malicious binary with large DataSize, Count, or Length values could previously trigger memory exhaustion.

Changes:

  • Added size limits for superblobs (50MB), blob counts (25), and individual blobs (16MB) -- these are fairly wide margins
  • Validates that data ranges actually fit within the file before reading
  • Caches file size to avoid repeated seeks during validation

Adding these checks did aggravate the linter, so a small refactor was done to decompose common parsing paths (e.g. parsing superblob and blob bytes).

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
@wagoodman wagoodman requested a review from a team March 10, 2026 14:44
@wagoodman wagoodman self-assigned this Mar 10, 2026
@wagoodman wagoodman added the security related to a security fix label Mar 10, 2026
@wagoodman wagoodman added this to OSS Mar 10, 2026
@wagoodman wagoodman moved this to In Review in OSS Mar 10, 2026
@wagoodman wagoodman merged commit 80cf3fe into main Mar 10, 2026
7 checks passed
@github-project-automation github-project-automation Bot moved this from In Review to Done in OSS Mar 10, 2026
@wagoodman wagoodman deleted the fix-read-lengths branch March 10, 2026 15:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

security related to a security fix

Projects

Archived in project

Development

Successfully merging this pull request may close these issues.

2 participants