Skip to content

[c166] Fix overflow #6599

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
SSharshunov wants to merge 4 commits into
base: dev
Choose a base branch
from
Open

[c166] Fix overflow #6599

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
a0f65f1
[c166] Fix overflow
SSharshunov Jul 5, 2026
02859f5
CID 911455
SSharshunov Jul 10, 2026
7602fda
CID 911454
SSharshunov Jul 10, 2026
8fdc9c9
CID 909873
SSharshunov Jul 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 3 additions & 6 deletions librz/arch/cpus/c166-c166-generic.sdb.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,9 +37,9 @@ IDX1.comment=MAC Address Pointer 1
ADEIC=io
ADEIC.address=0xff9a
ADEIC.comment=A/D Converter Overrun Error Interrupt Control Register
SYSCON=io
SYSCON.address=0xff0c
SYSCON.comment=CPU System Configuration Register
BUSCON0=io
BUSCON0.address=0xff0c
BUSCON0.comment=Bus Configuration Register 0 (Stack Pointer Segment Register [SPSEG])
VECSEG=io
VECSEG.address=0xff12
VECSEG.comment=Bus Configuration Register 0
Expand Down Expand Up @@ -313,9 +313,6 @@ CCM7.comment=CAPCOM Mode Control Register 7
CP=io
CP.address=0xfe10
CP.comment=CPU Context Pointer Register
R1=io
R1.address=0xfe12
R1.comment=General Purpose Word Register R1
CRIC=io
CRIC.address=0xff6a
CRIC.comment=GPT2 CAPREL Interrupt Ctrl. Register
Expand Down
3 changes: 1 addition & 2 deletions librz/arch/isa/c166/c166_disas.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -352,8 +352,7 @@ const char *c166_extx_names[] = {
};

RZ_API void c166_activate_ext(RZ_NONNULL C166State *state, ut32 addr, C166ExtState ext) {
// rz_return_if_fail(state->ext.i == 0); // realy need?
rz_return_if_fail(ext.i <= 3);
rz_return_if_fail(ext.i <= 4);
state->ext = ext;
state->last_addr = addr;
}
Expand Down
9 changes: 8 additions & 1 deletion librz/bin/format/omf/omf.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,18 +23,25 @@ static bool is_valid_omf_type(ut8 type) {
return true;
}
}
// RZ_LOG_ERROR("Invalid record type\n");
return false;
}

bool rz_bin_checksum_omf_ok(const ut8 *buf, ut64 buf_size) {
ut8 checksum = 0;
if (!buf) {
RZ_LOG_ERROR("Invalid record (buf is null)\n");
return false;
}

if (buf_size < 3) {
RZ_LOG_ERROR("Invalid record (too short)\n");
return false;
}
ut16 size = rz_read_le16(buf + 1);
if (size == 0 || size > UINT16_MAX) {
RZ_LOG_ERROR("Invalid record (untrusted value)\n");
return false;
}
if (buf_size < size + 3) {
RZ_LOG_ERROR("Invalid record (too short)\n");
return false;
Expand Down
3 changes: 2 additions & 1 deletion librz/bin/format/omf/omf.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -224,7 +224,7 @@ typedef enum omf_ityp_t {
/**
* Used to specify an object file as input for L166.
*/
ITYP_COMMANDLINE = 0x05, ///< Commandline descriptor.
ITYP_INVOCATION_LINE = 0xFF, ///< Invocation Line descriptor.
/**
* Contains the invocation line to the translator
* including all invocation controls.
Expand Down Expand Up @@ -719,6 +719,7 @@ typedef struct {

typedef struct {
ut8 bits;
ut64 base_addr;
ut8 modinfo;
int TI_INDEX;
int SEC_INDEX;
Expand Down
103 changes: 66 additions & 37 deletions librz/bin/format/omf/omf166.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -147,8 +147,6 @@ RZ_API const char *name_of_ti(const rz_bin_omf166_obj *obj, const ut16 ti_index)
return NULL;
}
}
rz_warn_if_reached();
return NULL;
}

const char *name_of_iTyp(ut8 iTyp) {
Expand All @@ -168,11 +166,11 @@ const char *name_of_iTyp(ut8 iTyp) {
case ITYP_OBJECT_INPUTFILE: {
return "Object-Inputfile";
}
case ITYP_COMMANDLINE: {
return "Commandline";
case ITYP_INVOCATION_LINE: {
return "InvocationLine";
}
default: {
rz_warn_if_reached();
RZ_LOG_WARN("UNKNOWN iTyp (%x).\n", iTyp);
return "UNKNOWN";
}
}
Expand Down Expand Up @@ -323,7 +321,7 @@ static ut16 omf166_get_idx(const ut8 *buf, const size_t buf_size) {
return ret;
}

static bool load_omf166_lnames(const rz_bin_omf166_obj *obj, const OMF_record *record, const ut8 *buf, const size_t buf_size, ut64 global_ct) {
static bool load_omf166_lnames(const rz_bin_omf166_obj *obj, const OMF_record *record, const ut8 *buf, const size_t buf_size) {
ut32 tmp_size = 0;
ut32 ct_name = 0;

Expand Down Expand Up @@ -380,8 +378,9 @@ static int load_omf166_global_sym_record(const rz_bin_omf166_obj *obj, const OMF
ct++;
base = rz_read_le32_offset(buf, &ct);
}
} else
} else {
base = rz_read_le32_offset(buf, &ct);
}

if (record->size <= ct) {
RZ_LOG_ERROR("Invalid sym record (bad size)\n");
Expand All @@ -396,7 +395,13 @@ static int load_omf166_global_sym_record(const rz_bin_omf166_obj *obj, const OMF
sym->rec_type = record->type;
sym->base = base;
sym->n = rz_read_le8_offset(buf, &ct);
rz_str_ncpy(sym->name2, (const char *)&buf[ct], sym->n + 1);
if (ct + sym->n + 1 > buf_size) {
RZ_LOG_ERROR("Invalid sym record (overflow)\n");
RZ_FREE(sym);
continue;
}
memcpy(sym->name2, buf + ct, sym->n);
sym->name2[sym->n] = '\0';

ct += sym->n;
sym->offset = rz_read_le16_offset(buf, &ct);
Expand Down Expand Up @@ -454,7 +459,7 @@ static int load_omf_data(const rz_bin_omf166_obj *obj, const ut8 *buf, const siz
return true;
}

static int load_omf_blkdef(const rz_bin_omf166_obj *obj, const ut8 *buf, const size_t buf_size, ut64 global_ct) {
static int load_omf_blkdef(const rz_bin_omf166_obj *obj, const ut8 *buf, const size_t buf_size) {
size_t ct = 3;
OMF_blocks *block = RZ_NEW0(OMF_blocks);
if (!block) {
Expand All @@ -470,7 +475,13 @@ static int load_omf_blkdef(const rz_bin_omf166_obj *obj, const ut8 *buf, const s
}

block->n = rz_read_le8_offset(buf, &ct);
rz_str_ncpy(block->name, (const char *)&buf[ct], block->n + 1);
if (ct + block->n + 1 > buf_size) {
RZ_LOG_ERROR("Invalid record (overflow)\n");
RZ_FREE(block);
return true;
}
memcpy(block->name, buf + ct, block->n);
block->name[block->n] = '\0';

ct += block->n;
block->BlockOffset16 = rz_read_le16_offset(buf, &ct);
Expand All @@ -488,7 +499,7 @@ static int load_omf_blkdef(const rz_bin_omf166_obj *obj, const ut8 *buf, const s
return true;
}

static int load_comment_data(const rz_bin_omf166_obj *obj, const ut8 *buf, const OMF_record *record, ut64 global_ct) {
static int load_comment_data(const rz_bin_omf166_obj *obj, const ut8 *buf, const OMF_record *record) {
if (!(obj && obj->coments_vec)) {
return false;
}
Expand All @@ -504,17 +515,13 @@ static int load_comment_data(const rz_bin_omf166_obj *obj, const ut8 *buf, const
comment->nopurge = (ComTyp_b1 & 0x80) >> 7;
comment->is_filename = (ComTyp_b2 == 0x4b);
comment->n = record->size + 3 - ct;
rz_str_ncpy(comment->text,
(const char *)&buf[ct], comment->n);
memcpy(comment->text, buf + ct, comment->n);
comment->text[comment->n] = '\0';
rz_pvector_push(obj->coments_vec, comment);
return true;
}

static int load_grpdef_data(const rz_bin_omf166_obj *obj, const ut8 *buf, const OMF_record *record, ut64 global_ct) {
if (!obj) {
return false;
}

/*
* Group Definition Record - Used to combine sections
*
Expand All @@ -531,12 +538,6 @@ static int load_grpdef_data(const rz_bin_omf166_obj *obj, const ut8 *buf, const
static int load_deplst_data(const ut8 *buf, const OMF_record *record) {
#if RZ_BUILD_DEBUG
size_t ct = 3;
const ut8 some_byte = rz_read_le8_offset(buf, &ct);
(void)some_byte;
const ut8 info_n = rz_read_le8_offset(buf, &ct);
char info[255] = RZ_EMPTY;
rz_str_ncpy(info, (const char *)&buf[ct], info_n + 1);
ct += info_n;
while (ct < record->size) {
/**
* iTyp | Mark8 | Time32 | Name(s)
Expand All @@ -550,8 +551,12 @@ static int load_deplst_data(const ut8 *buf, const OMF_record *record) {
In case of iTyp 4, more than one pathname may be specified.
*/
const ut8 iTyp = rz_read_le8_offset(buf, &ct);
const ut8 Mark8 = rz_read_le8_offset(buf, &ct);
const ut32 Time32 = rz_read_le32_offset(buf, &ct);
ut8 Mark8 = 0;
ut32 Time32 = 0;
if (iTyp != ITYP_INVOCATION_LINE) {
Mark8 = rz_read_le8_offset(buf, &ct);
Time32 = rz_read_le32_offset(buf, &ct);
}
const ut8 n = rz_read_le8_offset(buf, &ct);
char pathname[255] = RZ_EMPTY;
rz_str_ncpy(pathname,
Expand Down Expand Up @@ -597,7 +602,7 @@ static int load_linnum_data(const rz_bin_omf166_obj *obj, const ut8 *buf, const
return true;
}

static int load_omf_pedata(const rz_bin_omf166_obj *obj, const ut8 *buf, const OMF_record *record, const ut64 global_ct) {
static int load_omf_pedata(rz_bin_omf166_obj *obj, const ut8 *buf, const OMF_record *record, const ut64 global_ct) {
if (!(obj && obj->pe_vec)) {
return false;
}
Expand All @@ -622,6 +627,10 @@ static int load_omf_pedata(const rz_bin_omf166_obj *obj, const ut8 *buf, const O
*/
pe->size = pe->psize = record->size - 1 - (ct - 3);
pe->paddr = global_ct + ct;

if (pe->isVector) {
obj->base_addr = (ut32)pe->SegmentNumber8 << 16;
}
rz_pvector_push(obj->pe_vec, pe);
return true;
}
Expand Down Expand Up @@ -838,6 +847,8 @@ static int load_omf_typnew(rz_bin_omf166_obj *obj, const ut8 *buf) {
*/
const ut16 raw_count = rz_read_le16_offset(buf, &cct);
if (raw_count == 0 || raw_count > UINT16_MAX) {
RZ_LOG_ERROR("Invalid component count (untrusted value)\n");
RZ_FREE(newtype);
return false;
}
newtype->label = rz_str_dup("COMPONENT_LIST_DESCRIPTOR");
Expand All @@ -860,7 +871,8 @@ static int load_omf_typnew(rz_bin_omf166_obj *obj, const ut8 *buf) {
component->REP8 = rz_read_le8_offset(buf, &cct);
component->POS8 = rz_read_le8_offset(buf, &cct);
component->n = rz_read_le8_offset(buf, &cct);
rz_str_ncpy(component->name, (const char *)&buf[cct], component->n + 1);
memcpy(component->name, buf + cct, component->n);
component->name[component->n] = '\0';
cct += component->n;
}
break;
Expand Down Expand Up @@ -912,10 +924,10 @@ static int load_omf_typnew(rz_bin_omf166_obj *obj, const ut8 *buf) {
newtype->descriptor.struct_union.member_ti = rz_read_le16_offset(buf, &cct);
newtype->descriptor.struct_union.n = rz_read_le8_offset(buf, &cct);

rz_str_ncpy(
newtype->descriptor.struct_union.tagname,
(const char *)&buf[cct],
newtype->descriptor.struct_union.n + 1);
memcpy(newtype->descriptor.struct_union.tagname,
buf + cct,
newtype->descriptor.struct_union.n);
newtype->descriptor.struct_union.tagname[newtype->descriptor.struct_union.n] = '\0';
newtype->label = rz_str_dup(newtype->descriptor.struct_union.tagname);
break;
}
Expand Down Expand Up @@ -944,7 +956,7 @@ static int rz_bin_format_omf166_load_content(rz_bin_omf166_obj *obj, OMF_record

switch (record->type) {
case OMF166_LNAMES: {
return load_omf166_lnames(obj, record, buf, buf_size, global_ct);
return load_omf166_lnames(obj, record, buf, buf_size);
}
case OMF166_GLBDEF:
case OMF166_LOCSYM:
Expand All @@ -953,7 +965,7 @@ static int rz_bin_format_omf166_load_content(rz_bin_omf166_obj *obj, OMF_record
return load_omf166_global_sym_record(obj, record, buf, buf_size);
}
case OMF166_BLKDEF: {
return load_omf_blkdef(obj, buf, buf_size, global_ct);
return load_omf_blkdef(obj, buf, buf_size);
}
case OMF166_VECTAB:
case OMF166_PEDATA: {
Expand All @@ -963,8 +975,13 @@ static int rz_bin_format_omf166_load_content(rz_bin_omf166_obj *obj, OMF_record
case OMF166_THEADR: {
char name[255] = RZ_EMPTY;
size_t offset = 3;
ut8 n = rz_read_le8_offset(buf, &offset);
rz_str_ncpy(name, (const char *)&buf[offset], n + 1);
const ut8 n = rz_read_le8_offset(buf, &offset);
if (n + 1 + offset > buf_size) {
RZ_LOG_WARN("File may be corrupted (Overflow detected).\n");
} else {
memcpy(name, buf + offset, n);
name[n] = '\0';
}
RZ_LOG_DEBUG("load_omf = %s = [0x%08" PFMT64x "] (%05d) `%s`\n",
record->type == OMF166_THEADR ? "THEADR" : "LHEADR",
global_ct,
Expand Down Expand Up @@ -999,7 +1016,7 @@ static int rz_bin_format_omf166_load_content(rz_bin_omf166_obj *obj, OMF_record
return true;
}
case OMF166_COMMENT: {
return load_comment_data(obj, buf, record, global_ct);
return load_comment_data(obj, buf, record);
}
case OMF166_GRPDEF: {
return load_grpdef_data(obj, buf, record, global_ct);
Expand Down Expand Up @@ -1039,7 +1056,12 @@ static int rz_bin_format_omf166_load_content(rz_bin_omf166_obj *obj, OMF_record
while (record->size - 1 > left) {
char name[255] = RZ_EMPTY;
const ut8 n = rz_read_le8_offset(buf, &left);
rz_str_ncpy(name, (const char *)&buf[left], n + 1);
if (n + 1 + left > buf_size) {
RZ_LOG_WARN("File may be corrupted (Overflow detected).\n");
} else {
memcpy(name, buf + left, n);
name[n] = '\0';
}
left += n;
}
return true;
Expand All @@ -1056,6 +1078,11 @@ static int rz_bin_format_omf166_load_content(rz_bin_omf166_obj *obj, OMF_record
case OMF166_UNKNOWN4: {
return load_omf_unk4(buf, buf_size, record, global_ct);
}
case OMF166_SSKDEF: {
RZ_LOG_DEBUG("load_omf: [%05d] [0x%08" PFMT64x "] 0x%02x (%" PFMTSZu ")\n",
record->size, global_ct, record->type, buf_size);
return true;
}
default: {
RZ_LOG_DEBUG("load_omf: [%05d] [0x%08" PFMT64x "] 0x%02x (%" PFMTSZu ")\t",
record->size, global_ct, record->type, buf_size);
Expand Down Expand Up @@ -1083,6 +1110,8 @@ static OMF_record *rz_bin_format_omf166_load_record(rz_bin_omf166_obj *obj, cons
new->type = rz_read_le8_offset(buf, &offset);
const ut16 raw_count = rz_read_le16_offset(buf, &offset);
if (raw_count == 0 || raw_count > UINT16_MAX) {
RZ_LOG_ERROR("Invalid record (untrusted value)\n");
RZ_FREE(new);
return false;
}
new->size = raw_count;
Expand Down
10 changes: 8 additions & 2 deletions librz/bin/p/bin_c166.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,7 @@ rz_bin_c166_obj *rz_bin_format_c166_load(const ut8 *buf, ut64 size) {
return NULL;
}
const ut8 c = rz_read_le8(buf + 1);
ret->base_addr = c << 16 | 0x000000;
ret->base_addr = (ut32)c << 16;
return ret;
}

Expand Down Expand Up @@ -111,7 +111,7 @@ static RzPVector /*<RzBinAddr *>*/ *entries(RzBinFile *bf) {
if (!bf || !bf->o || !bf->o->bin_obj) {
return NULL;
}
rz_bin_c166_obj *obj = bf->o->bin_obj;
const rz_bin_c166_obj *obj = bf->o->bin_obj;

RzPVector *ret;
RzBinAddr *addr;
Expand Down Expand Up @@ -158,6 +158,11 @@ static RzBinAddr *binsym(RzBinFile *bf, RzBinSpecialSymbol type) {
}
}

static ut64 baddr(RzBinFile *bf) {
const rz_bin_c166_obj *obj = (rz_bin_c166_obj *)bf->o->bin_obj;
return obj->base_addr;
}

struct rz_bin_plugin_t rz_bin_plugin_c166 = {
.name = "c166",
.desc = "Siemens/Infineon C166 family microcontroller binary",
Expand All @@ -171,6 +176,7 @@ struct rz_bin_plugin_t rz_bin_plugin_c166 = {
.info = &info,
.binsym = &binsym,
.strings = &strings,
.baddr = baddr
};

#ifndef RZ_PLUGIN_INCORE
Expand Down
Loading
Loading