Fix #22349 - oobread in xnu kernelcache ##crash

* Reproducer rabin_hbo_194 * Reported by @gandalf4a
radareorg · Oct 29, 2023 · 40c9f50 · 40c9f50
1 parent 386d948
commit 40c9f50
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/libr/bin/p/bin_xnu_kernelcache.c b/libr/bin/p/bin_xnu_kernelcache.c
@@ -988,7 +988,7 @@ static void process_constructors(RKernelCacheObj *obj, struct MACH0_(obj_t) *mac
 		}
 		int j;
 		int count = 0;
-		for (j = 0; j < section->size; j += 8) {
+		for (j = 0; j + 7 < section->size; j += 8) {
 			ut64 addr64 = K_RPTR (buf + j);
 			ut64 paddr64 = section->paddr + paddr + j;
 			if (mode == R_K_CONSTRUCTOR_TO_ENTRY) {