From a25c20ee0b4c0f287ed8d15f22968efe8994e184 Mon Sep 17 00:00:00 2001
From: John Reiser <jreiser@BitWagon.com>
Date: Thu, 20 Mar 2025 09:48:00 -0700
Subject: [PATCH] M_LZMA with hi parameter bytes confused --ultra-brute

https://github.com/upx/upx/issues/900
	modified:   packhead.cpp
	modified:   p_lx_elf.cpp
---
 src/p_lx_elf.cpp | 12 ++++++------
 src/packhead.cpp |  5 ++++-
 2 files changed, 10 insertions(+), 7 deletions(-)

diff --git a/src/p_lx_elf.cpp b/src/p_lx_elf.cpp
index dc002b6b..d7f435aa 100644
--- a/src/p_lx_elf.cpp
+++ b/src/p_lx_elf.cpp
@@ -1534,7 +1534,7 @@ PackLinuxElf32::buildLinuxLoader(
 //   SO_MAIN  C-language supervision based on PT_LOADs
         char sec[120]; memset(sec, 0, sizeof(sec));  // debug convenience
         int len = 0;
-        unsigned m_decompr = methods_used | (1u << ph_forced_method(ph.method));
+        unsigned m_decompr = methods_used | (1u << (0xFF & ph_forced_method(ph.method)));
         len += snprintf(sec, sizeof(sec), "%s", "SO_HEAD,ptr_NEXT,EXP_HEAD");
 
         // Start of dasiy-chain fall-through.
@@ -1586,7 +1586,7 @@ PackLinuxElf32::buildLinuxLoader(
         initLoader(fold, szfold);
         char sec[120]; memset(sec, 0, sizeof(sec));  // debug convenience
         int len = 0;
-        unsigned m_decompr = methods_used | (1u << ph_forced_method(ph.method));
+        unsigned m_decompr = methods_used | (1u << (0xFF & ph_forced_method(ph.method)));
         len += snprintf(sec, sizeof(sec), "%s", ".text,EXP_HEAD");
         if (((1u<<M_NRV2B_LE32)|(1u<<M_NRV2B_8)|(1u<<M_NRV2B_LE16)) & m_decompr) {
             len += snprintf(&sec[len], sizeof(sec) - len, ",%s", "NRV2B");
@@ -1692,7 +1692,7 @@ PackLinuxElf32::buildLinuxLoader(
             defineSymbols(ft);
     }
     else { // main program with ELF1 de-compressor
-        addStubEntrySections(ft, methods_used | (1u << ph_forced_method(ph.method)) );
+        addStubEntrySections(ft, methods_used | (1u << (0xFF & ph_forced_method(ph.method))) );
         if (!xct_off) { // main program
             defineSymbols(ft);
         }
@@ -1731,7 +1731,7 @@ PackLinuxElf64::buildLinuxLoader(
 //   SO_MAIN  C-language supervision based on PT_LOADs
         char sec[120]; memset(sec, 0, sizeof(sec));  // debug convenience
         int len = 0;
-        unsigned m_decompr = methods_used | (1u << ph_forced_method(ph.method));
+        unsigned m_decompr = methods_used | (1u << (0xFF & ph_forced_method(ph.method)));
         len += snprintf(sec, sizeof(sec), "%s", "SO_HEAD,ptr_NEXT,EXP_HEAD");
 
         // Start of dasiy-chain fall-through.
@@ -1776,7 +1776,7 @@ PackLinuxElf64::buildLinuxLoader(
         initLoader(fold, szfold);
         char sec[120]; memset(sec, 0, sizeof(sec));  // debug convenience
         int len = 0;
-        unsigned m_decompr = methods_used | (1u << ph_forced_method(ph.method));
+        unsigned m_decompr = methods_used | (1u << (0xFF & ph_forced_method(ph.method)));
         len += snprintf(sec, sizeof(sec), "%s", ".text,EXP_HEAD");
         if (((1u<<M_NRV2B_LE32)|(1u<<M_NRV2B_8)|(1u<<M_NRV2B_LE16)) & m_decompr) {
             len += snprintf(&sec[len], sizeof(sec) - len, ",%s", "NRV2B");
@@ -1881,7 +1881,7 @@ PackLinuxElf64::buildLinuxLoader(
         }
     }
     else { // main program with ELF1 de-compressor
-        addStubEntrySections(ft, methods_used | (1u << ph_forced_method(ph.method)) );
+        addStubEntrySections(ft, methods_used | (1u << (0xFF & ph_forced_method(ph.method))) );
         if (!xct_off) { // main program
             defineSymbols(ft);
         }
diff --git a/src/packhead.cpp b/src/packhead.cpp
index 4f293f39..0ed8211b 100644
--- a/src/packhead.cpp
+++ b/src/packhead.cpp
@@ -47,7 +47,10 @@ void PackHeader::reset() noexcept {
 
 int PackHeader::set_method(int m, unsigned offset) {
     unsigned mc = ~(0x80u << 24) & m; // see ph_forced_method
-    if ((mc < M_NRV2B_LE32 || M_LZMA < mc) && ~0u != offset)
+    unsigned lo = 0xFF & m;
+    // See packer_c.cpp for "hi bytes" in M_LZMA_003 and M_LZMA_407.
+    // "hi bytes" are not allowed unless M_LZMA.
+    if ((lo < M_NRV2B_LE32 || M_LZMA < lo || (M_LZMA != lo && mc != lo)) && ~0u != offset)
         throwCantPack("bad method %#x at %#x", (unsigned) m, offset);
     return method = m;
 }