stumbled on this while engaging similar symptoms; clang and ios,
example for within “a-shell” app. sounds like there may likely be a
lot more across ecosystems from where this came from.

https://github.com/holzschu/a-shell/issues/306

a-Shell 180 (1.7.4) | iPad8,12 | iPhone OS 14.7.1 (18G82) | Crash |
PoC | EXC_BAD_ACCESS (SIGSEGV)

> Hello-
>
> Crasher PoC: printf 'k80x&::((**\ne::' | clang -x c++ -
>
> Hardware Model: iPad8,12 OS Version: iPhone OS 14.7.1 (18G82)
>
> Run Twice, See Seg Fault 11
>
> A few comments:
>
> 1. There is no printf obviously
> 2. The PoC needs to be run twice to SegFault 11
>
> Hopefully this is enough info to be able to reproduce the Crash.
>
> If I should Report this Issue elsewhere, please let me know.
>
> Thank You
>
> ```
> Exception Type:  EXC_BAD_ACCESS (SIGSEGV)
> Exception Subtype: KERN_INVALID_ADDRESS at 0x0000000000000030
> VM Region Info: 0x30 is not in any region.  Bytes before following region: 
> 4310319056
>       REGION TYPE                 START - END      [ VSIZE] PRT/MAX SHRMOD  
> REGION DETAIL
>       UNUSED SPACE AT START
> --->
>       __TEXT                   100ea4000-100eb4000 [   64K] r-x/r-x SM=COW  
> ...l.app/a-Shell
>
> Termination Signal: Segmentation fault: 11
> Termination Reason: Namespace SIGNAL, Code 0xb
> Terminating Process: exc handler [873]
> Triggered by Thread:  7
> ```
>
>  ```
> Thread 7 Crashed:
> 0   libLLVM                           0x000000011ac0b3ac 0x11aa70000 + 1684396
> 1   libLLVM                           0x000000011ac0b3ac 0x11aa70000 + 1684396
> 2   libLLVM                           0x000000011ac0a654 0x11aa70000 + 1680980
> 3   clang                             0x0000000118a6a4fc 0x1179b8000 + 
> 17507580
> 4   clang                             0x0000000118a65e34 0x1179b8000 + 
> 17489460
> 5   clang                             0x0000000118cac278 0x1179b8000 + 
> 19874424
> 6   clang                             0x0000000117b91770 0x1179b8000 + 1939312
> 7   clang                             0x000000011978c108 0x1179b8000 + 
> 31277320
> 8   clang                             0x00000001197284b8 0x1179b8000 + 
> 30868664
> 9   clang                             0x00000001181719e8 0x1179b8000 + 8100328
> 10  clang                             0x00000001179ff258 0x1179b8000 + 291416
> 11  clang                             0x00000001179fdc8c 0x1179b8000 + 285836
> 12  clang                             0x00000001179fd7c0 0x1179b8000 + 284608
> 13  ios_system                        0x000000010106f9ec 0x10105c000 + 80364
> 14  libsystem_pthread.dylib           0x00000001e2d84bfc _pthread_start + 320
> 15  libsystem_pthread.dylib           0x00000001e2d8d758 thread_start + 8
> ```
>
>  ```
> Binary Images:
> 0x100ea4000 - 0x100fa3fff a-Shell arm64  <88956ced9ba437d88874ba38cc57427e> 
> /var/containers/Bundle/Application/86CDE0DF-BA4F-48FC-81C7-69FFE57C266C/a-Shell.app/a-Shell
> 0x10105c000 - 0x101073fff ios_system arm64  
> <2a600cbb4ddd34c2adfde7d5935447d5> 
> /var/containers/Bundle/Application/86CDE0DF-BA4F-48FC-81C7-69FFE57C266C/a-Shell.app/Frameworks/ios_system.framework/ios_system
> 0x10116c000 - 0x101177fff libobjc-trampolines.dylib arm64e  
> <bc30b5bd95c23ac1972f6d7eeb3d252f> /usr/lib/libobjc-trampolines.dylib
> 0x101318000 - 0x10138bfff dyld arm64e  <b8adece0d2cc3c958d01c5fa21bc74ea> 
> /usr/lib/dyld
> 0x1179b8000 - 0x119a1ffff clang arm64  <91b77adf969f34c8b7287a0b7fe11038> 
> /var/containers/Bundle/Application/86CDE0DF-BA4F-48FC-81C7-69FFE57C266C/a-Shell.app/Frameworks/clang.framework/clang
> 0x11aa70000 - 0x11cf93fff libLLVM arm64  <46390f69e7cb36fd98844c6164b4e274> 
> /var/containers/Bundle/Application/86CDE0DF-BA4F-48FC-81C7-69FFE57C266C/a-Shell.app/Frameworks/libLLVM.framework/libLLVM
> ```



> Hi, thanks for the report; I can confirm that this example also fails on my 
> machine. I'll see if I can fix it. Update: it does not fail when running in 
> Debug mode, which would point towards non-initialized variables.
>
> Out of curiosity, how did you arrive at that example? Would any non-existant 
> command also produce the issue?



> Hi,
>
> I'm using an Apple Security Research Device and working outward to points of 
> impact. Then, I'm running the Reproducer on retail Run Targets to Confirm & 
> Report.
>
> * running in Debug mode, which would point towards non-initialized variables.
>
> Yes, I noted this in my updated Feedback to Apple. I am now making Reports 
> downstream to IOS Projects where the Community can evaluate the issues 
> transparently and I can cull the Results.
>
> -Out of curiosity, how did you arrive at that example? Would any non-existant 
> command also produce the issue
>
> The PoC was found circa 2015 in LLDB Bug Reports from myself and others, I 
> was not the original Reporter, but performed significant Fuzzing at that time 
> which still has a Corpus that delivers PoC Crashers across the XNU ecosystem. 
> I too am looking at the non-existant command issue. Apple so far is No-Fix on 
> this issue so I am now Reporting the Issue to Downstream Projects.
>
> The Feedback Case == FB9591834 with Subject == 20G95 | 13A5212g | 
> clang-1300.0.29.3 | Logic Bug | PoC | Segmentation fault: 11
>
> Please let me know if I can provide any additional information.
>
> Thank You!



> New



> Hello-
>
> Here is another Crasher PoC. It will need to be run a few times to generate 
> the Crash. This is another circa 2015 CLANG Crasher that has been won't fix 
> like the other PoC. I've tested this on iPad 12 Pro, iPhone 12 Pro both 
> running Retail iOS15, and also verified on SRD running iOS 15.1 Beta.
>
> echo "g34( struct Yunsignedp 
> char32_t=char32_t_35==ZcregisterZtypename&&S=4autobitand8 &&or* 
> xor{static_cast&char32_t&welseconst auto" | clang -x c++ -
  • [old] public... Undescribed Horrific Abuse, One Victim & Survivor of Many
    • Re: [ol... Undescribed Horrific Abuse, One Victim & Survivor of Many
    • Re: [ol... Undescribed Horrific Abuse, One Victim & Survivor of Many
      • Re:... Undescribed Horrific Abuse, One Victim & Survivor of Many
        • ... Undescribed Horrific Abuse, One Victim & Survivor of Many

Reply via email to