From dbf511b3ec575b9b5036983ce8c4748a7f5cb985 Mon Sep 17 00:00:00 2001 From: kaffeindecaf Date: Tue, 11 Aug 2026 12:07:36 +0200 Subject: [PATCH] =?UTF-8?q?fix:=20hardening=20=E2=80=94=20NULL=20check,=20?= =?UTF-8?q?max=5Finode=20bound,=20stopAccessing=20leak?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - bad_query_list: add NULL path check and clamp max_inode to UINT32_MAX - ContentView.swift: add stopAccessingSecurityScopedResource via defer (was leaking kernel security-scoped resource) --- bad_query/ContentView.swift | 1 + bad_query/bad_query.c | 2 ++ 2 files changed, 3 insertions(+) diff --git a/bad_query/ContentView.swift b/bad_query/ContentView.swift index 242691f..49085ba 100644 --- a/bad_query/ContentView.swift +++ b/bad_query/ContentView.swift @@ -108,6 +108,7 @@ struct ContentView: View { func replace(source: URL) throws { log.append("\nattempting replace mobilegestalt cache...") let accessed = source.startAccessingSecurityScopedResource() + defer { if accessed { source.stopAccessingSecurityScopedResource() } } if !accessed { log.append("\nfailed to access replacement?") throw NSError(domain: "sbhaxx", code: 2) diff --git a/bad_query/bad_query.c b/bad_query/bad_query.c index dce2c4d..4e85344 100644 --- a/bad_query/bad_query.c +++ b/bad_query/bad_query.c @@ -148,6 +148,8 @@ void bad_query_release(int64_t handle) { // I'm including it here because it's very useful in the context of this sandbox escape, which can't access parent directories (most of the time) // This enumerates all directories in a given path, so you can, for example, get all container UUIDs, read their container metadata to get their bundle ID, and derive that entirely on-device without a computer char *bad_query_list(char *path, int64_t max_inode) { + if (!path || !*path) return NULL; + if (max_inode <= 0 || max_inode > 0xFFFFFFFF) max_inode = 0xFFFFFFFF; struct statfs sfs; if (statfs(path, &sfs) != 0) return NULL; fsid_t fsid = sfs.f_fsid;