`unpack-pbp`: unvalidated PBP offsets → silent file clobbering and attacker-sized write; `psp-prxgen`: unbounded `strcpy` of section name

Open
  • Is something wrong?
#412 4 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
45/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
c
Domain
security, tooling

Research direction

Start with tools/unpack-pbp.c and tools/psp-prxgen.c, then inspect the header and section definitions in tools/elftypes.h. Check how the tools read PBP offsets and ELF section names, and add validation for malformed input as described in the issue. Done means invalid offsets and overlong or unterminated section names are rejected safely; verify with the supplied reproductions or create equivalent malformed inputs.

Written by the indexing model from the issue text.

Description

unpack-pbp: unvalidated offsets → attacker-sized output write (up to ~2 GiB per section); psp-prxgen: unbounded strcpy of section name

Two separate input-validation bugs in tools/. I'm reporting them privately rather than
posting full exploit detail: this repo has no SECURITY.md and "Private vulnerability
reporting" is disabled. Could you either enable it or tell me a preferred contact?

Both tools consume untrusted third-party artifacts (PBP / ELF), so the impact lands in
whatever developer machine or packaging pipeline processes such a file.

1. tools/unpack-pbp.c — header offsets are never validated (CWE-400 / CWE-1284)
if (loop0 == 7) size = total_size - header.offset[loop0];        /* :131 */
else            size = header.offset[loop0 + 1] - header.offset[loop0];  /* :133 */
if (!size) continue;                                             /* :140 */
...
readsize = size;                                                 /* :169 */
fread(buffer, readsize, 1, infile);                              /* :174 */
fwrite(buffer, readsize, 1, outfile);                            /* :182 */
} while (size);                                                  /* :189 */

The eight offsets come straight from the file and are never checked for monotonicity or
against the real file size; if (!size) is the only length gate, and it rejects exactly
zero. Two consequences, both reproduced by compiling the file as-is in a sandbox:

  • Attacker-sized output write. A 140-byte PBP with offset[7] = 0x7FFFFFF0 makes the
    tool write a DATA.PSP with no relation to the input size: the loop runs
    ceil(size / 16 MiB) times, so the section tops out at ~2 GiB and the tool then exits
    0. fread returns 0 at EOF, but the return value is only tested as result < 0 on a
    size_t — always false — so short reads go unnoticed and the stale 16 MB buffer keeps
    being written out (the tail of the file is unrelated heap content).
  • Negative length. offset[i+1] < offset[i] gives a negative size; on glibc the
    fread call then fails with EOVERFLOW and the tool silently writes a 0-byte file.
    No memory corruption there — I want to be precise about that, since it's the kind of
    thing that gets miscategorised.

Net effect: attacker-controlled disk consumption (~2 GiB per crafted section, and eight
sections are unpacked in one run) and silent clobbering of files in the working directory,
from a 140-byte input. Not a memory-safety bug, but it is a real
availability/integrity issue for anything that auto-processes PBPs.

2. tools/psp-prxgen.c — unbounded strcpy of the section name (CWE-121)
strcpy(g_elfsections[i].szName,
       (char *)(g_elfsections[g_elfhead.iShstrndx].pData + g_elfsections[i].iName));  /* :303 */

szName is char[ELF_SECT_MAX_NAME] = char[128] (tools/elftypes.h:20,49); the source
is the shstrtab string at the attacker-controlled sh_name offset, with no length check
and no guarantee of NUL-termination inside the table.

Reproduced: a hand-built 384-byte ELF whose section name is 200 bytes, compiled with
-D_FORTIFY_SOURCE=2, aborts with *** buffer overflow detected *** at :303; the same
file with a 100-byte name runs to the normal "no sceModuleInfo section found" path. Under
ASan the 200-byte name corrupts the adjacent ElfSection entries and faults inside
load_sections. 120 bytes of overflow into a global array — worth fixing regardless of
how the tool is invoked.

Fix for both: validate the PBP offset table right after the signature check
(non-decreasing, >= sizeof(HEADER), <= total_size, and reject short fread), and
bound the section-name copy to ELF_SECT_MAX_NAME - 1 while rejecting over-long names.

Happy to send the two input files and the build commands, and to open a PR against a
branch of your choosing.

Regards,
贵志的猫

Dominant language
C
Stars
1.2k
Forks
190
Avg merge
1d 15h
Merged PRs (30d)
12

Getting set up

  • Ships a Dockerfile or Docker Compose file
  • No pull request template
  • No contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from pspdev/pspsdk

All issues in pspdev/pspsdk

Similar issues

More C issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.