rust-macho icon indicating copy to clipboard operation
rust-macho copied to clipboard

fix oom when iterating binding opcodes

Open Orycterope opened this issue 6 months ago • 0 comments

Found this bug while fuzzing the library.

If the macho is malformed and has a rebase opcode of RebaseOpcode::RebaseAndSkipping { times: 0xffffffff, skip: 0x4 }, the iterator will try to process the opcode in a single call to Iterator::next(), pushing all the genearted symbols to an internal VecDeque, only to return them one at a time to the user on subsequent calls.

This is bad because when times is an absurdly high number, the iterator will cause an OOM trying to push all the symbols to its VecDeque, and the user has no control on this behaviour.

Change the implementation to be closer to what a proper generator would do, by remembering which instruction we were processing last time, restarting from where we left off, and decrementing times every time we yield a value. This removes the need for allocations entirely.

This does not fundamentally solve the issue, but at least now the iterator does not OOM when calling next(), and the user can use Iterator::take(limit) to avoid pulling an (almost) infinite stream of symbols.

Orycterope avatar Aug 09 '24 13:08 Orycterope