mirror of
https://github.com/revanced/Apktool.git
synced 2024-08-28 18:16:41 +02:00
Hardened String Block Parser (#3239)
* fix: add headerSize to stringBlock to detect larger headers * fix: handle app with style offset, but 0 styles * refactor: split counting stream into CountingDataInput * fix: read strings till end of string pool chunk * fix: support out of bound string reading * fix: don't read string/style offset out of bounds * refactor: cleanup comments for string parser * style: comment on 4 byte alignment * fix: only warn if utf16 string
This commit is contained in:
parent
9f8c1b3711
commit
7c2cb5b30a
@ -16,8 +16,8 @@
|
||||
*/
|
||||
package brut.androlib.res.data.arsc;
|
||||
|
||||
import brut.util.ExtCountingDataInput;
|
||||
import brut.util.ExtDataInput;
|
||||
import org.apache.commons.io.input.CountingInputStream;
|
||||
|
||||
import java.io.EOFException;
|
||||
import java.io.IOException;
|
||||
@ -39,23 +39,23 @@ public class ARSCHeader {
|
||||
this.endPosition = headerStart + chunkSize;
|
||||
}
|
||||
|
||||
public static ARSCHeader read(ExtDataInput in, CountingInputStream countIn) throws IOException {
|
||||
public static ARSCHeader read(ExtCountingDataInput in) throws IOException {
|
||||
short type;
|
||||
int start = countIn.getCount();
|
||||
int start = in.position();
|
||||
try {
|
||||
type = in.readShort();
|
||||
} catch (EOFException ex) {
|
||||
return new ARSCHeader(RES_NONE_TYPE, 0, 0, countIn.getCount());
|
||||
return new ARSCHeader(RES_NONE_TYPE, 0, 0, in.position());
|
||||
}
|
||||
return new ARSCHeader(type, in.readShort(), in.readInt(), start);
|
||||
}
|
||||
|
||||
public void checkForUnreadHeader(ExtDataInput in, CountingInputStream countIn) throws IOException {
|
||||
public void checkForUnreadHeader(ExtCountingDataInput in) throws IOException {
|
||||
// Some applications lie about the reported size of their chunk header. Trusting the chunkSize is misleading
|
||||
// So compare to what we actually read in the header vs reported and skip the rest.
|
||||
// However, this runs after each chunk and not every chunk reading has a specific distinction between the
|
||||
// header and the body.
|
||||
int actualHeaderSize = countIn.getCount() - this.startPosition;
|
||||
int actualHeaderSize = in.position() - this.startPosition;
|
||||
int exceedingSize = this.headerSize - actualHeaderSize;
|
||||
if (exceedingSize > 0) {
|
||||
byte[] buf = new byte[exceedingSize];
|
||||
|
@ -22,9 +22,8 @@ import brut.androlib.res.data.*;
|
||||
import brut.androlib.res.data.arsc.*;
|
||||
import brut.androlib.res.data.value.*;
|
||||
import brut.util.Duo;
|
||||
import brut.util.ExtDataInput;
|
||||
import brut.util.ExtCountingDataInput;
|
||||
import com.google.common.io.LittleEndianDataInputStream;
|
||||
import org.apache.commons.io.input.CountingInputStream;
|
||||
|
||||
import java.io.*;
|
||||
import java.math.BigInteger;
|
||||
@ -52,16 +51,12 @@ public class ARSCDecoder {
|
||||
}
|
||||
|
||||
private ARSCDecoder(InputStream arscStream, ResTable resTable, boolean storeFlagsOffsets, boolean keepBroken) {
|
||||
arscStream = mCountIn = new CountingInputStream(arscStream);
|
||||
if (storeFlagsOffsets) {
|
||||
mFlagsOffsets = new ArrayList<>();
|
||||
} else {
|
||||
mFlagsOffsets = null;
|
||||
}
|
||||
// We need to explicitly cast to DataInput as otherwise the constructor is ambiguous.
|
||||
// We choose DataInput instead of InputStream as ExtDataInput wraps an InputStream in
|
||||
// a DataInputStream which is big-endian and ignores the little-endian behavior.
|
||||
mIn = new ExtDataInput((DataInput) new LittleEndianDataInputStream(arscStream));
|
||||
mIn = new ExtCountingDataInput(new LittleEndianDataInputStream(arscStream));
|
||||
mResTable = resTable;
|
||||
mKeepBroken = keepBroken;
|
||||
}
|
||||
@ -126,20 +121,20 @@ public class ARSCDecoder {
|
||||
|
||||
private void readStringPoolChunk() throws IOException, AndrolibException {
|
||||
checkChunkType(ARSCHeader.RES_STRING_POOL_TYPE);
|
||||
mTableStrings = StringBlock.readWithoutChunk(mIn, mHeader.chunkSize);
|
||||
mTableStrings = StringBlock.readWithoutChunk(mIn, mHeader.startPosition, mHeader.headerSize, mHeader.chunkSize);
|
||||
}
|
||||
|
||||
private void readTableChunk() throws IOException, AndrolibException {
|
||||
checkChunkType(ARSCHeader.RES_TABLE_TYPE);
|
||||
mIn.skipInt(); // packageCount
|
||||
|
||||
mHeader.checkForUnreadHeader(mIn, mCountIn);
|
||||
mHeader.checkForUnreadHeader(mIn);
|
||||
}
|
||||
|
||||
private void readUnknownChunk() throws IOException, AndrolibException {
|
||||
checkChunkType(ARSCHeader.RES_NULL_TYPE);
|
||||
|
||||
mHeader.checkForUnreadHeader(mIn, mCountIn);
|
||||
mHeader.checkForUnreadHeader(mIn);
|
||||
|
||||
LOGGER.warning("Skipping unknown chunk data of size " + mHeader.chunkSize);
|
||||
mHeader.skipChunk(mIn);
|
||||
@ -177,7 +172,7 @@ public class ARSCDecoder {
|
||||
LOGGER.warning("Please report this application to Apktool for a fix: https://github.com/iBotPeaches/Apktool/issues/1728");
|
||||
}
|
||||
|
||||
mHeader.checkForUnreadHeader(mIn, mCountIn);
|
||||
mHeader.checkForUnreadHeader(mIn);
|
||||
|
||||
mTypeNames = StringBlock.readWithChunk(mIn);
|
||||
mSpecNames = StringBlock.readWithChunk(mIn);
|
||||
@ -195,7 +190,7 @@ public class ARSCDecoder {
|
||||
int packageId;
|
||||
String packageName;
|
||||
|
||||
mHeader.checkForUnreadHeader(mIn, mCountIn);
|
||||
mHeader.checkForUnreadHeader(mIn);
|
||||
|
||||
for (int i = 0; i < libraryCount; i++) {
|
||||
packageId = mIn.readInt();
|
||||
@ -207,7 +202,7 @@ public class ARSCDecoder {
|
||||
private void readStagedAliasSpec() throws IOException {
|
||||
int count = mIn.readInt();
|
||||
|
||||
mHeader.checkForUnreadHeader(mIn, mCountIn);
|
||||
mHeader.checkForUnreadHeader(mIn);
|
||||
|
||||
for (int i = 0; i < count; i++) {
|
||||
LOGGER.fine(String.format("Skipping staged alias stagedId (%h) finalId: %h", mIn.readInt(), mIn.readInt()));
|
||||
@ -219,7 +214,7 @@ public class ARSCDecoder {
|
||||
String name = mIn.readNullEndedString(256, true);
|
||||
String actor = mIn.readNullEndedString(256, true);
|
||||
|
||||
mHeader.checkForUnreadHeader(mIn, mCountIn);
|
||||
mHeader.checkForUnreadHeader(mIn);
|
||||
|
||||
LOGGER.fine(String.format("Overlay name: \"%s\", actor: \"%s\")", name, actor));
|
||||
}
|
||||
@ -229,7 +224,7 @@ public class ARSCDecoder {
|
||||
mIn.skipInt(); // policyFlags
|
||||
int count = mIn.readInt();
|
||||
|
||||
mHeader.checkForUnreadHeader(mIn, mCountIn);
|
||||
mHeader.checkForUnreadHeader(mIn);
|
||||
|
||||
for (int i = 0; i < count; i++) {
|
||||
LOGGER.fine(String.format("Skipping overlay (%h)", mIn.readInt()));
|
||||
@ -244,10 +239,10 @@ public class ARSCDecoder {
|
||||
int entryCount = mIn.readInt();
|
||||
|
||||
if (mFlagsOffsets != null) {
|
||||
mFlagsOffsets.add(new FlagsOffset(mCountIn.getCount(), entryCount));
|
||||
mFlagsOffsets.add(new FlagsOffset(mIn.position(), entryCount));
|
||||
}
|
||||
|
||||
mHeader.checkForUnreadHeader(mIn, mCountIn);
|
||||
mHeader.checkForUnreadHeader(mIn);
|
||||
|
||||
mIn.skipBytes(entryCount * 4); // flags
|
||||
mTypeSpec = new ResTypeSpec(mTypeNames.getString(id - 1), mResTable, mPkg, id, entryCount);
|
||||
@ -272,7 +267,7 @@ public class ARSCDecoder {
|
||||
mMissingResSpecMap = new LinkedHashMap<>();
|
||||
ResConfigFlags flags = readConfigFlags();
|
||||
|
||||
mHeader.checkForUnreadHeader(mIn, mCountIn);
|
||||
mHeader.checkForUnreadHeader(mIn);
|
||||
|
||||
if ((typeFlags & 0x01) != 0) {
|
||||
LOGGER.fine("Sparse type flags detected: " + mTypeSpec.getName());
|
||||
@ -310,7 +305,7 @@ public class ARSCDecoder {
|
||||
mResId = (mResId & 0xffff0000) | i;
|
||||
|
||||
// As seen in some recent APKs - there are more entries reported than can fit in the chunk.
|
||||
if (mCountIn.getCount() == mHeader.endPosition) {
|
||||
if (mIn.position() == mHeader.endPosition) {
|
||||
int remainingEntries = entryCount - i;
|
||||
LOGGER.warning(String.format("End of chunk hit. Skipping remaining entries (%d) in type: %s",
|
||||
remainingEntries, mTypeSpec.getName()
|
||||
@ -325,8 +320,8 @@ public class ARSCDecoder {
|
||||
}
|
||||
|
||||
// skip "TYPE 8 chunks" and/or padding data at the end of this chunk
|
||||
if (mCountIn.getCount() < mHeader.endPosition) {
|
||||
long bytesSkipped = mCountIn.skip(mHeader.endPosition - mCountIn.getCount());
|
||||
if (mIn.position() < mHeader.endPosition) {
|
||||
long bytesSkipped = mIn.skip(mHeader.endPosition - mIn.position());
|
||||
LOGGER.warning("Unknown data detected. Skipping: " + bytesSkipped + " byte(s)");
|
||||
}
|
||||
|
||||
@ -630,7 +625,7 @@ public class ARSCDecoder {
|
||||
}
|
||||
|
||||
private ARSCHeader nextChunk() throws IOException {
|
||||
return mHeader = ARSCHeader.read(mIn, mCountIn);
|
||||
return mHeader = ARSCHeader.read(mIn);
|
||||
}
|
||||
|
||||
private void checkChunkType(int expectedType) throws AndrolibException {
|
||||
@ -640,9 +635,8 @@ public class ARSCDecoder {
|
||||
}
|
||||
}
|
||||
|
||||
private final ExtDataInput mIn;
|
||||
private final ExtCountingDataInput mIn;
|
||||
private final ResTable mResTable;
|
||||
private final CountingInputStream mCountIn;
|
||||
private final List<FlagsOffset> mFlagsOffsets;
|
||||
private final boolean mKeepBroken;
|
||||
|
||||
|
@ -24,9 +24,8 @@ import brut.androlib.res.data.ResTable;
|
||||
import brut.androlib.res.data.arsc.ARSCHeader;
|
||||
import brut.androlib.res.data.axml.NamespaceStack;
|
||||
import brut.androlib.res.xml.ResXmlEncoders;
|
||||
import brut.util.ExtDataInput;
|
||||
import brut.util.ExtCountingDataInput;
|
||||
import com.google.common.io.LittleEndianDataInputStream;
|
||||
import org.apache.commons.io.input.CountingInputStream;
|
||||
import org.xmlpull.v1.XmlPullParserException;
|
||||
|
||||
import java.io.*;
|
||||
@ -64,11 +63,7 @@ public class AXmlResourceParser implements XmlResourceParser {
|
||||
public void open(InputStream stream) {
|
||||
close();
|
||||
if (stream != null) {
|
||||
stream = mCountIn = new CountingInputStream(stream);
|
||||
// We need to explicitly cast to DataInput as otherwise the constructor is ambiguous.
|
||||
// We choose DataInput instead of InputStream as ExtDataInput wraps an InputStream in
|
||||
// a DataInputStream which is big-endian and ignores the little-endian behavior.
|
||||
mIn = new ExtDataInput((DataInput) new LittleEndianDataInputStream(stream));
|
||||
mIn = new ExtCountingDataInput(new LittleEndianDataInputStream(stream));
|
||||
}
|
||||
}
|
||||
|
||||
@ -79,7 +74,6 @@ public class AXmlResourceParser implements XmlResourceParser {
|
||||
}
|
||||
isOperational = false;
|
||||
mIn = null;
|
||||
mCountIn = null;
|
||||
mStringBlock = null;
|
||||
mResourceIds = null;
|
||||
mNamespaces.reset();
|
||||
@ -687,8 +681,8 @@ public class AXmlResourceParser implements XmlResourceParser {
|
||||
}
|
||||
|
||||
// #2070 - Some applications have 2 start namespaces, but only 1 end namespace.
|
||||
if (mCountIn.available() == 0) {
|
||||
LOGGER.warning(String.format("AXML hit unexpected end of file at byte: 0x%X", mCountIn.getCount()));
|
||||
if (mIn.remaining() == 0) {
|
||||
LOGGER.warning(String.format("AXML hit unexpected end of file at byte: 0x%X", mIn.position()));
|
||||
mEvent = END_DOCUMENT;
|
||||
break;
|
||||
}
|
||||
@ -715,7 +709,7 @@ public class AXmlResourceParser implements XmlResourceParser {
|
||||
if (chunkType < ARSCHeader.RES_XML_FIRST_CHUNK_TYPE || chunkType > ARSCHeader.RES_XML_LAST_CHUNK_TYPE) {
|
||||
int chunkSize = mIn.readInt();
|
||||
mIn.skipBytes(chunkSize - 8);
|
||||
LOGGER.warning(String.format("Unknown chunk type at: (0x%08x) skipping...", mCountIn.getCount()));
|
||||
LOGGER.warning(String.format("Unknown chunk type at: (0x%08x) skipping...", mIn.position()));
|
||||
break;
|
||||
}
|
||||
|
||||
@ -806,8 +800,7 @@ public class AXmlResourceParser implements XmlResourceParser {
|
||||
}
|
||||
}
|
||||
|
||||
private ExtDataInput mIn;
|
||||
private CountingInputStream mCountIn;
|
||||
private ExtCountingDataInput mIn;
|
||||
private ResAttrDecoder mAttrDecoder;
|
||||
private AndrolibException mFirstError;
|
||||
|
||||
|
@ -18,7 +18,7 @@ package brut.androlib.res.decoder;
|
||||
|
||||
import brut.androlib.res.data.arsc.ARSCHeader;
|
||||
import brut.androlib.res.xml.ResXmlEncoders;
|
||||
import brut.util.ExtDataInput;
|
||||
import brut.util.ExtCountingDataInput;
|
||||
import com.google.common.annotations.VisibleForTesting;
|
||||
|
||||
import java.io.IOException;
|
||||
@ -30,15 +30,18 @@ import java.util.List;
|
||||
import java.util.logging.Logger;
|
||||
|
||||
public class StringBlock {
|
||||
public static StringBlock readWithChunk(ExtDataInput reader) throws IOException {
|
||||
public static StringBlock readWithChunk(ExtCountingDataInput reader) throws IOException {
|
||||
int startPosition = reader.position();
|
||||
reader.skipCheckShort(ARSCHeader.RES_STRING_POOL_TYPE);
|
||||
reader.skipShort(); // headerSize
|
||||
int headerSize = reader.readShort();
|
||||
int chunkSize = reader.readInt();
|
||||
|
||||
return readWithoutChunk(reader, chunkSize);
|
||||
return readWithoutChunk(reader, startPosition, headerSize, chunkSize);
|
||||
}
|
||||
|
||||
public static StringBlock readWithoutChunk(ExtDataInput reader, int chunkSize) throws IOException {
|
||||
public static StringBlock readWithoutChunk(ExtCountingDataInput reader, int startPosition, int headerSize,
|
||||
int chunkSize) throws IOException
|
||||
{
|
||||
// ResStringPool_header
|
||||
int stringCount = reader.readInt();
|
||||
int styleCount = reader.readInt();
|
||||
@ -46,28 +49,42 @@ public class StringBlock {
|
||||
int stringsOffset = reader.readInt();
|
||||
int stylesOffset = reader.readInt();
|
||||
|
||||
StringBlock block = new StringBlock();
|
||||
block.m_isUTF8 = (flags & UTF8_FLAG) != 0;
|
||||
block.m_stringOffsets = reader.readIntArray(stringCount);
|
||||
|
||||
if (styleCount != 0) {
|
||||
block.m_styleOffsets = reader.readIntArray(styleCount);
|
||||
// For some applications they pack the StringBlock header with more unused data at end.
|
||||
if (headerSize > STRING_BLOCK_HEADER_SIZE) {
|
||||
reader.skipBytes(headerSize - STRING_BLOCK_HEADER_SIZE);
|
||||
}
|
||||
|
||||
StringBlock block = new StringBlock();
|
||||
block.m_isUTF8 = (flags & UTF8_FLAG) != 0;
|
||||
block.m_stringOffsets = reader.readSafeIntArray(stringCount, startPosition + stringsOffset);
|
||||
|
||||
if (styleCount != 0) {
|
||||
block.m_styleOffsets = reader.readSafeIntArray(styleCount, startPosition + stylesOffset);
|
||||
}
|
||||
|
||||
// #3236 - Some applications give a style offset, but have 0 styles. Make this check more robust.
|
||||
boolean hasStyles = stylesOffset != 0 && styleCount != 0;
|
||||
int size = chunkSize - stringsOffset;
|
||||
|
||||
// If we have both strings and even just a lying style offset - lets calculate the size of the strings without
|
||||
// accidentally parsing all the styles.
|
||||
if (styleCount > 0) {
|
||||
size = stylesOffset - stringsOffset;
|
||||
}
|
||||
|
||||
int size = ((stylesOffset == 0) ? chunkSize : stylesOffset) - stringsOffset;
|
||||
block.m_strings = new byte[size];
|
||||
reader.readFully(block.m_strings);
|
||||
|
||||
if (stylesOffset != 0) {
|
||||
size = (chunkSize - stylesOffset);
|
||||
if (hasStyles) {
|
||||
size = chunkSize - stylesOffset;
|
||||
block.m_styles = reader.readIntArray(size / 4);
|
||||
}
|
||||
|
||||
// read remaining bytes
|
||||
int remaining = size % 4;
|
||||
if (remaining >= 1) {
|
||||
while (remaining-- > 0) {
|
||||
reader.readByte();
|
||||
}
|
||||
// In case we aren't 4 byte aligned we need to skip the remaining bytes.
|
||||
int remaining = size % 4;
|
||||
if (remaining >= 1) {
|
||||
while (remaining-- > 0) {
|
||||
reader.readByte();
|
||||
}
|
||||
}
|
||||
|
||||
@ -211,6 +228,11 @@ public class StringBlock {
|
||||
LOGGER.warning("Failed to decode a string at offset " + offset + " of length " + length);
|
||||
return null;
|
||||
}
|
||||
} catch (IndexOutOfBoundsException ex) {
|
||||
if (!m_isUTF8) {
|
||||
LOGGER.warning("String extends outside of pool at " + offset + " of length " + length);
|
||||
return null;
|
||||
}
|
||||
}
|
||||
|
||||
try {
|
||||
@ -275,4 +297,5 @@ public class StringBlock {
|
||||
private static final Logger LOGGER = Logger.getLogger(StringBlock.class.getName());
|
||||
|
||||
private static final int UTF8_FLAG = 0x00000100;
|
||||
private static final int STRING_BLOCK_HEADER_SIZE = 28;
|
||||
}
|
||||
|
@ -17,4 +17,5 @@
|
||||
dependencies {
|
||||
implementation project(':brut.j.common')
|
||||
implementation depends.commons_io
|
||||
implementation depends.guava
|
||||
}
|
||||
|
@ -0,0 +1,72 @@
|
||||
/*
|
||||
* Copyright (C) 2010 Ryszard Wiśniewski <brut.alll@gmail.com>
|
||||
* Copyright (C) 2010 Connor Tumbleson <connor.tumbleson@gmail.com>
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* https://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
package brut.util;
|
||||
|
||||
import org.apache.commons.io.input.CountingInputStream;
|
||||
import com.google.common.io.LittleEndianDataInputStream;
|
||||
|
||||
import java.io.DataInput;
|
||||
import java.io.IOException;
|
||||
import java.util.logging.Logger;
|
||||
|
||||
public class ExtCountingDataInput extends ExtDataInput {
|
||||
private final CountingInputStream mCountIn;
|
||||
|
||||
public ExtCountingDataInput(LittleEndianDataInputStream in) {
|
||||
this(new CountingInputStream(in));
|
||||
}
|
||||
|
||||
public ExtCountingDataInput(CountingInputStream countIn) {
|
||||
// We need to explicitly cast to DataInput as otherwise the constructor is ambiguous.
|
||||
// We choose DataInput instead of InputStream as ExtDataInput wraps an InputStream in
|
||||
// a DataInputStream which is big-endian and ignores the little-endian behavior.
|
||||
super((DataInput) new LittleEndianDataInputStream(countIn));
|
||||
mCountIn = countIn;
|
||||
}
|
||||
|
||||
public int position() {
|
||||
return mCountIn.getCount();
|
||||
}
|
||||
|
||||
public int remaining() throws IOException {
|
||||
return mCountIn.available();
|
||||
}
|
||||
|
||||
public long skip(int bytes) throws IOException {
|
||||
return mCountIn.skip(bytes);
|
||||
}
|
||||
|
||||
public int[] readSafeIntArray(int length, long maxPosition) throws IOException {
|
||||
int[] array = new int[length];
|
||||
|
||||
for (int i = 0; i < length; i++) {
|
||||
// #3236 - In some applications we have more strings than fit into the block. This function takes
|
||||
// an expected max position and if we are past it, we return early during processing.
|
||||
if (position() >= maxPosition) {
|
||||
LOGGER.warning(String.format("Bad string block: string entry is at %d, past end at %d",
|
||||
position(), maxPosition)
|
||||
);
|
||||
return array;
|
||||
}
|
||||
|
||||
array[i] = readInt();
|
||||
}
|
||||
return array;
|
||||
}
|
||||
|
||||
private static final Logger LOGGER = Logger.getLogger(ExtCountingDataInput.class.getName());
|
||||
}
|
Loading…
Reference in New Issue
Block a user