fix memory corruptions in systemwide / launchd hook, safety improvements

opa334 · Apr 13, 2023 · de8f79b · de8f79b
1 parent 22bbabe
commit de8f79b
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 6 deletions.
diff --git a/BaseBin/systemhook/src/common.c b/BaseBin/systemhook/src/common.c
@@ -177,7 +177,7 @@ char *resolvePath(const char *file, const char *searchPath)
 	char fullpath[1024];
 
 	while (dir != NULL) {
-		sprintf(fullpath, "%s/%s", dir, file);
+		snprintf(fullpath, 1024, "%s/%s", dir, file);
 		if (access(fullpath, X_OK) == 0) {
 			return strdup(fullpath);
 		}
@@ -445,7 +445,8 @@ int spawn_hook_common(pid_t *restrict pid, const char *restrict path,
 						}
 						else {
 							strncpy(&replacementLibraryInsertStr[0], existingLibraryInsertStr, existingLibraryStart-existingLibraryInsertStr);
-							strncpy(&replacementLibraryInsertStr[strlen(replacementLibraryInsertStr)], afterStart, strlen(afterStart));
+							strncpy(&replacementLibraryInsertStr[existingLibraryStart-existingLibraryInsertStr], afterStart, strlen(afterStart));
+							replacementLibraryInsertStr[existingLibraryStart-existingLibraryInsertStr+strlen(afterStart)] = '\0';
 						}
 					}
 				}
@@ -455,7 +456,7 @@ int spawn_hook_common(pid_t *restrict pid, const char *restrict path,
 			}
 
 			size_t noSafeModeEnvCount = ogEnvCount - (existingSafeModeIndex != -1) - (existingMSSafeModeIndex != -1) - (replacementLibraryInsertStr == NULL);
-			char **noSafeModeEnv = malloc(noSafeModeEnvCount * sizeof(char *));
+			char **noSafeModeEnv = malloc((noSafeModeEnvCount+1) * sizeof(char *));
 			int ci = 0;
 			for (int i = 0; i < ogEnvCount; i++) {
 				if (existingSafeModeIndex != -1) {

diff --git a/BaseBin/systemhook/src/main.c b/BaseBin/systemhook/src/main.c
@@ -1,9 +1,9 @@
-#import "common.h"
-#import "unsandbox.h"
+#include "common.h"
+#include "unsandbox.h"
 
 #include <mach-o/dyld.h>
 #include <dlfcn.h>
-#import <sys/sysctl.h>
+#include <sys/sysctl.h>
 
 void* dlopen_from(const char* path, int mode, void* addressInCaller);
 void* dlopen_audited(const char* path, int mode);