LuLu crashes for processes using non-UTF8 arguments

[xnyhps]

Process arguments on macOS do not have a defined or enforced encoding. UTF8 is common, but nothing prevents a process from using something non-UTF8.

LuLu (and I suspect some other Objective-See tools too) assumes arguments are UTF8:

LuLu/LuLu/Extension/Process.m

Lines 474 to 478 in aafab24

	if(NULL != argStart)
	{
	//save
	[self.arguments addObject:[NSString stringWithUTF8String:argStart]];
	}

When a C string which is not valid UTF8 is used, -[NSString stringWithUTF8String:] returns nil. When attempting to add a nil object to an NSMutableArray, it throws an exception. This exception is not caught, which means the network extension crashes.

After the network extension crashes, internet access is unfiltered for a short time while it restarts. This makes it possible for malware to bypass LuLu by making it crash and then quickly accessing the network.

I recommend fixing this by either ignoring arguments that are invalid UTF8, or using NSData for storing arguments.

[objective-see]

Thanks! Good catch 😅
...just pushed a commit to fix the issue. Will make it into the next release!

[objective-see]

fixed release v2.3.0