Open Radar

 
Summary:
In macOS 10,12, dyldPath is a new member of dyld_all_image_infos, declared in <mach-o/dyld_images.h>.

In testing, I have found that dyld_all_image_infos is not NUL-terminated, rendering this field useless. I can consistently reproduce this when running a 32-bit executable at a relative path from a working directory whose path’s length is longer than dyld’s path’s length.

Steps to Reproduce:
dyld_path.cc is the attached test program.

$ mkdir xxxxxxxxxxxxxx
$ clang++ -arch i386 -std=c++11 dyld_path.cc -o xxxxxxxxxxxxxx/dyld_path
$ cd xxxxxxxxxxxxxx
$ pwd
/Users/litterbox/xxxxxxxxxxxxxx
$ ./dyld_path
/usr/lib/dyldbox/xxxxxxxxxxxxxx

Expected Results:
The test program should print the path to dyld, normally /usr/lib/dyld.

Actual Results:
The test program overwrites a buffer containing the working directory with the path to dyld, but does not NUL-terminate dyld’s path, so if the working directory’s path’s length is longer than dyld’s, trailing junk from the working directory’s path will appear appended to dyld’s. In the example, it prints /usr/lib/dyldbox/xxxxxxxxxxxxxx, which is not a valid path to anything, and certainly not dyld’s path.

Version:
10.12 16A201w

Configuration:
I have observed this bug in a 32-bit process when running the test program at a relative path.

I have not yet observed this bug in a 64-bit process or when running the test program at an absolute path, although I haven’t tried very hard to trigger the bug in those scenarios.

--
dyld_path.cc

// clang++ -arch i386 -std=c++11 dyld_path.cc -o dyld_path

#include <mach/mach.h>
#include <mach-o/dyld.h>
#include <mach-o/dyld_images.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

const dyld_all_image_infos* DyldGetAllImageInfos() {
  // This could call _dyld_get_all_image_infos(), but that's non-public.

  task_dyld_info_data_t dyld_info;
  mach_msg_type_number_t count = TASK_DYLD_INFO_COUNT;
  kern_return_t kr = task_info(mach_task_self(),
                               TASK_DYLD_INFO,
                               reinterpret_cast<task_info_t>(&dyld_info),
                               &count);
  if (kr != KERN_SUCCESS) {
    return nullptr;
  }

  return reinterpret_cast<dyld_all_image_infos*>(dyld_info.all_image_info_addr);
}

int main(int argc, char* argv[]) {
  const dyld_all_image_infos* dyld_image_infos = DyldGetAllImageInfos();

  bool success = false;
  if (dyld_image_infos->version >= 15) {
    printf("%s\n", dyld_image_infos->dyldPath);
    if (strcmp(dyld_image_infos->dyldPath, "/usr/lib/dyld") == 0) {
      success = true;
    }
  }

  return success ? EXIT_SUCCESS : EXIT_FAILURE;
}