Fix java oobread in id_000000,sig_06,sync_m1,src_000048 ##crash

* Reported by Cen Zhang via huntr.dev
radareorg · Feb 7, 2022 · 79b39bb · 79b39bb
1 parent 4a8d975
commit 79b39bb
Show file tree

Hide file tree

Showing 4 changed files with 10 additions and 7 deletions.
diff --git a/libr/anal/Makefile b/libr/anal/Makefile
@@ -85,6 +85,7 @@ tests-esil:
 .PHONY: do doclean
 
 do:
+	$(MAKE) -C ../asm/arch/arm/v35arm64
 	$(MAKE) -C d
 
 doclean:

diff --git a/shlr/java/class.c b/shlr/java/class.c
@@ -7148,9 +7148,11 @@ R_API RBinJavaAnnotationsArray *r_bin_java_annotation_array_new(ut8 *buffer, ut6
 
 R_API RBinJavaAttrInfo *r_bin_java_rtv_annotations_attr_new(RBinJavaObj *bin, ut8 *buffer, ut64 sz, ut64 buf_offset) {
 	ut32 i = 0;
-	RBinJavaAttrInfo *attr = NULL;
 	ut64 offset = 0;
-	attr = r_bin_java_default_attr_new (bin, buffer, sz, buf_offset);
+	if (buf_offset + 8 > sz) {
+		return NULL;
+	}
+	RBinJavaAttrInfo *attr = r_bin_java_default_attr_new (bin, buffer, sz, buf_offset);
 	offset += 6;
 	if (attr) {
 		attr->type = R_BIN_JAVA_ATTR_TYPE_RUNTIME_VISIBLE_ANNOTATION_ATTR;

diff --git a/sys/rebuild.sh b/sys/rebuild.sh
@@ -18,13 +18,13 @@ Rebuild() {
 	cd "$1" || exit 1
 	$MAKE clean
 	$MAKE -j8 || exit 1
-	cd -
+	cd - > /dev/null
 }
 
 Build() {
 	cd "$1" || exit 1
 	$MAKE -j8 || exit 1
-	cd -
+	cd - > /dev/null
 }
 
 RebuildIOSDebug() {
@@ -48,9 +48,9 @@ RebuildSpp() {
 
 RebuildJava() {
 	Rebuild shlr/java
+	Rebuild libr/bin
 	Rebuild libr/asm
 	Rebuild libr/anal
-	Rebuild libr/bin
 	Rebuild libr/core
 }
 

diff --git a/sys/sanitize.sh b/sys/sanitize.sh
@@ -2,8 +2,8 @@
 # SANITIZE="address leak memory undefined"
 # SANITIZE="address signed-integer-overflow"  # Faster build
 # default:
-# SANITIZE=${SANITIZE:="address undefined signed-integer-overflow"}
-SANITIZE=${SANITIZE:="thread"}
+SANITIZE=${SANITIZE:="address undefined signed-integer-overflow"}
+# SANITIZE=${SANITIZE:="thread"}
 
 printf "\033[32m"
 echo "========================================================================="