Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Very long loop while parsing in MachOFile::parse #515

Closed
Pastequee opened this issue Feb 16, 2023 · 1 comment · Fixed by #516
Closed

Very long loop while parsing in MachOFile::parse #515

Pastequee opened this issue Feb 16, 2023 · 1 comment · Fixed by #516

Comments

@Pastequee
Copy link

Hello, while fuzzing I found a binary file (probably ill-formed) that takes around 10 minutes to be parsed on my machine. But the file is only 396 bytes. This might not be a bug and just an expected outcome of the binary lying about its data, but it would be nice if this can be avoided.
What I've discovered if this can help is that this while loop in MachOFile::parse is looping all the time over commands.next()

while let Ok(Some(command)) = commands.next() {
if let Some((segment, section_data)) = Mach::Segment::from_command(command)? {
let segment_index = segments.len();
segments.push(MachOSegmentInternal { segment, data });
for section in segment.sections(endian, section_data)? {
let index = SectionIndex(sections.len() + 1);
sections.push(MachOSectionInternal::parse(index, segment_index, section));
}
} else if let Some(symtab) = command.symtab()? {
symbols = symtab.symbols(endian, data)?;
}
}

And the next implementation of LoadCommandIterator is decrementing its inner variable ncmds by 1 each iteration and returning None when it's 0. But the thing is the initial value of ncmds is 3 992 977 412 😮

Here is the file to reproduce: test.zip

@philipc
Copy link
Contributor

philipc commented Feb 17, 2023

Thanks very much for the report. That test file also uncovered a couple more bugs, all fixed in #516.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants