Add YAML Mach-O parser fixtures

- Cover malformed command sizes, bounds and string offsets.
- Exercise byte order, build metadata and runtime paths.

Author: MikeMcQuaid

lib/macho/exceptions.rb

@@ -126,6 +126,14 @@ def initialize(num)
     end
   end
 
+  # Raised when a load command has an invalid size.
+  class LoadCommandSizeError < NotAMachOError
+    # @param size [Integer] the invalid size
+    def initialize(size)
+      super("Invalid Mach-O load command size: #{size}")
+    end
+  end
+
   # Raised when a load command can't be created manually.
   class LoadCommandNotCreatableError < MachOError
     # @param cmd_sym [Symbol] the uncreatable load command's symbol

lib/macho/load_commands.rb

@@ -332,6 +332,8 @@ def initialize(lc, lc_str)
           view = lc.view
 
           if view
+            raise LCStrMalformedError, lc if lc_str < lc.class.bytesize || lc_str >= lc.cmdsize
+
             lc_str_abs = view.offset + lc_str
             lc_end = view.offset + lc.cmdsize - 1
             raw_string = view.raw_data.slice(lc_str_abs..lc_end)

lib/macho/macho_file.rb

@@ -579,17 +579,27 @@ def check_filetype(filetype)
 
     # All load commands in the file.
     # @return [Array<LoadCommands::LoadCommand>] an array of load commands
+    # @raise [TruncatedFileError] if the declared load command data is incomplete
     # @raise [LoadCommandError] if an unknown load command is encountered
+    # @raise [LoadCommandSizeError] if a load command's size is invalid
     # @api private
     def populate_load_commands
       permissive = options.fetch(:permissive, false)
       offset = header.class.bytesize
+      load_commands_end = offset + sizeofcmds
+      raise TruncatedFileError if load_commands_end > @raw_data.bytesize
+
       load_commands = []
       @load_commands_by_type = Hash.new { |h, k| h[k] = [] }
 
       header.ncmds.times do
+        raise TruncatedFileError if offset + LoadCommands::LoadCommand.bytesize > load_commands_end
+
         fmt = Utils.specialize_format("L=", endianness)
         cmd = @raw_data.slice(offset, 4).unpack1(fmt)
+        cmdsize = @raw_data.slice(offset + 4, 4).unpack1(fmt)
+        raise LoadCommandSizeError, cmdsize if cmdsize % 4 != 0 || offset + cmdsize > load_commands_end
+
         cmd_sym = LoadCommands::LOAD_COMMANDS[cmd]
 
         raise LoadCommandError, cmd unless cmd_sym || permissive
@@ -602,6 +612,8 @@ def populate_load_commands
           LoadCommands::LoadCommand
         end
 
+        raise LoadCommandSizeError, cmdsize if cmdsize < klass.bytesize
+
         view = MachOView.new(self, @raw_data, endianness, offset)
         command = klass.new_from_bin(view)
 

test/bin/yaml2obj/Makefile

@@ -0,0 +1,8 @@
+YAMLS := $(wildcard *.yaml)
+MACHOS := $(YAMLS:.yaml=.macho)
+
+.PHONY: all
+all: $(MACHOS)
+
+%.macho: %.yaml
+	yaml2obj $< -o $@

test/bin/yaml2obj/big-endian.macho

@@ -0,0 +1,11 @@
+--- !mach-o
+IsLittleEndian: false
+FileHeader:
+  magic: 0xFEEDFACE
+  cputype: 0x00000007
+  cpusubtype: 0x00000003
+  filetype: 0x00000001
+  ncmds: 0
+  sizeofcmds: 0
+  flags: 0x00000000
+...

test/bin/yaml2obj/big-endian.yaml

@@ -0,0 +1,22 @@
+--- !mach-o
+IsLittleEndian: true
+FileHeader:
+  magic: 0xFEEDFACF
+  cputype: 0x01000007
+  cpusubtype: 0x00000003
+  filetype: 0x00000002
+  ncmds: 1
+  sizeofcmds: 32
+  flags: 0x00000000
+  reserved: 0x00000000
+LoadCommands:
+  - cmd: LC_BUILD_VERSION
+    cmdsize: 32
+    platform: 2
+    minos: 0x00080000
+    sdk: 0x00090000
+    ntools: 1
+    Tools:
+      - tool: 1
+        version: 0
+...

test/bin/yaml2obj/build-version.macho

@@ -0,0 +1,18 @@
+--- !mach-o
+IsLittleEndian: true
+FileHeader:
+  magic: 0xFEEDFACF
+  cputype: 0x01000007
+  cpusubtype: 0x00000003
+  filetype: 0x00000002
+  ncmds: 1
+  sizeofcmds: 24
+  flags: 0x00000000
+  reserved: 0x00000000
+LoadCommands:
+  - cmd: LC_LOAD_DYLINKER
+    cmdsize: 24
+    name: 0
+    Content: test
+    ZeroPadBytes: 8
+...