rust-macho
rust-macho copied to clipboard
fix oom when iterating binding opcodes
Found this bug while fuzzing the library.
If the macho is malformed and has a rebase opcode of RebaseOpcode::RebaseAndSkipping { times: 0xffffffff, skip: 0x4 }
, the iterator will try to process the opcode in a single call to Iterator::next()
, pushing all the genearted symbols to an internal VecDeque, only to return them one at a time to the user on subsequent calls.
This is bad because when times
is an absurdly high number, the iterator will cause an OOM trying to push all the symbols to its VecDeque, and the user has no control on this behaviour.
Change the implementation to be closer to what a proper generator would do, by remembering which instruction we were processing last time, restarting from where we left off, and decrementing times
every time we yield a value. This removes the need for allocations entirely.
This does not fundamentally solve the issue, but at least now the iterator does not OOM when calling next()
, and the user can use Iterator::take(limit)
to avoid pulling an (almost) infinite stream of symbols.