Fix oobread in dyldcache ##crash

* Reported by @hdthky via huntr.dev * Reproducers: poc1 * BountyID: 8ae2c61a-2220-47a5-bfe8-fe6d41ab1f82
radareorg · Apr 5, 2022 · 2b77b27 · 2b77b27
1 parent c35d162
commit 2b77b27
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 2 deletions.
diff --git a/libr/bin/format/mach0/dyldcache.h b/libr/bin/format/mach0/dyldcache.h
@@ -1,4 +1,4 @@
-/* radare - LGPL - Copyright 2009-2010 nibble<.ds@gmail.com> */
+/* radare - LGPL - Copyright 2009-2022 nibble, pancake */
 
 #include <r_types.h>
 #include "mach0_specs.h"

diff --git a/libr/bin/p/bin_dyldcache.c b/libr/bin/p/bin_dyldcache.c
@@ -1247,7 +1247,8 @@ static RList *create_cache_bins(RBinFile *bf, RDyldCache *cache) {
 			if (deps && !deps[j]) {
 				continue;
 			}
-			ut64 pa = va2pa (img[j].address, hdr->mappingCount, &cache->maps[maps_index], cache->buf, 0, NULL, NULL);
+			// ut64 pa = va2pa (img[j].address, hdr->mappingCount, &cache->maps[maps_index], cache->buf, 0, NULL, NULL);
+			ut64 pa = va2pa (img[j].address, cache->n_maps, &cache->maps[maps_index], cache->buf, 0, NULL, NULL);
 			if (pa == UT64_MAX) {
 				continue;
 			}