about summary refs log tree commit diff
diff options
context:
space:
mode:
authorYour Name <you@example.com>2023-08-30 17:17:55 +0100
committerYour Name <you@example.com>2023-08-30 17:17:55 +0100
commitd6e7740ad6bab0f5a0d34a96561d80ccbafd6073 (patch)
tree43440ee30431d4e6d452b91d68925842d21a5323
parentc60431247e971881bc159a84e5505dfec7adcf6d (diff)
downloadafl++-d6e7740ad6bab0f5a0d34a96561d80ccbafd6073.tar.gz
Don't corrupt instruction if map offset is too large
-rw-r--r--frida_mode/src/instrument/instrument_arm64.c12
1 files changed, 12 insertions, 0 deletions
diff --git a/frida_mode/src/instrument/instrument_arm64.c b/frida_mode/src/instrument/instrument_arm64.c
index 2256f941..a0c66697 100644
--- a/frida_mode/src/instrument/instrument_arm64.c
+++ b/frida_mode/src/instrument/instrument_arm64.c
@@ -402,6 +402,18 @@ bool instrument_write_inline(GumArm64Writer *cw, GumAddress code_addr,
 
   }
 
+  /* 
+   * The mov instruction supports up to a 16-bit offset. If our offset is out of 
+   * range, then it can end up clobbering the op-code portion of the instruction 
+   * rather than just the operands. So return false and fall back to the 
+   * alternative instrumentation.
+   */
+  if (area_offset > UINT16_MAX) {
+
+    return false;
+    
+  }
+
   code.code.mov_x0_curr_loc |= area_offset << 5;
 
   if (!instrument_patch_ardp(