I found a bug by participating to the Binary Golf Grand Prix 3 (https://tmpout.sh/bggp/3/) : upx text.exe segfaults when NumberOfSections in the IMAGE_FILE_HEADER is NULL, so
if (memcmp(isection[0].name,"UPX",3) == 0) triggers a NULL pointer dereference causing a crash.
To fix it, just have to check if isection is NULL (which means NumberOfSections = 0) or not.
- for (unsigned j=0; (k = dt_names[j]); ++j) {
+ for (unsigned j=0; ((k = dt_names[j]), k); ++j) {
The complaint was:
p_lx_elf.cpp(5710) : warning C4706: assignment within conditional expression
which is INCORRECT, as shown in the change which is 100% equivalent.
The assignment occurs BEFORE the conditional expression.
modified: p_lx_elf.cpp
Fix includes a more-general and stronger heuristic to find the end of
GNU_HASH table when there is no ElfXX_Shdr for it. 64-bit only for now.
(This is needed to help prevent SIGSEGV when processing tampered .exe.)
https://github.com/upx/upx/issues/577
modified: p_elf_enum.h
modified: p_lx_elf.cpp
modified: p_lx_elf.h
Force all pieces to use the same de-compressor.
(Future: allow each PT_LOAD to choose its own.)
Has minor wobbles due to page alignment, and size of de-compressor.
64-bit only for now.
https://github.com/upx/upx/issues/570https://github.com/upx/upx/issues/297
modified: p_lx_elf.cpp
modified: p_unix.cpp
modified: packer.cpp
modified: packer.h
Requirements for success after snipping a loader_command:
"codesign -s - my_app" must succeed.
"lldb my_app; process launch -s; continue" must succeed.
Optional loader_commands (macho-snip can remove these successfully):
LC_UUID, LC_BUILD_VERSION, LC_SOURCE_VERISON,
LC_DATA_IN_CODE (when 0==datasize)
Apple "strip -N" clears out LC_SYMTAB and LC_DYSYMTAB, but leaves
LC_DYLD_INFO_ONLY.export_size. Perhaps this could be zero if
constructed that way; snipping seems tedious because codesign
requires that __LINKEDIT must have no gaps.
LC_FUNCTION_STARTS seems to be required by codesign.
codesign wants offsets that point into __LINKEDIT to be in order:
LC_DYLD_INFO_ONLY, LC_FUNCTION_STARTS, LC_DATA_IN_CODE, LC_SYMTAB
MacOS seesm to require LC_LOAD_DYLINKER (else "zsh: Kiled"),
which seems to require LD_LOAD_DYLIB (else SIGABRT).
https://github.com/upx/upx/issues/446
----
modified: macho-snip.c
modified: udf.s
when building a tool to investigate "minimal" Mach-O executable
on Apple MacOS Big Sur using Apple M1 hardware (aarch64).
https://github.com/upx/upx/issues/567
modified: stub/tools/macho-snip/Makefile
modified: stub/tools/macho-snip/macho-snip.c
modified: stub/tools/macho-snip/udf.s
