Fix crash in UIAccessibilityStatusUtility rebinding logic

cashapp · Jan 24, 2024 · 3a6b9eb · 3a6b9eb
1 parent 60222bf
commit 3a6b9eb
Showing 1 changed file with 10 additions and 45 deletions.
diff --git a/Sources/AccessibilitySnapshot/Core/ObjC/UIAccessibilityStatusUtility.m b/Sources/AccessibilitySnapshot/Core/ObjC/UIAccessibilityStatusUtility.m
@@ -153,41 +153,15 @@ static int prepend_rebindings(struct rebindings_entry **rebindings_head,
     return 0;
 }
 
-static vm_prot_t get_protection(void *sectionStart) {
-    mach_port_t task = mach_task_self();
-    vm_size_t size = 0;
-    vm_address_t address = (vm_address_t)sectionStart;
-    memory_object_name_t object;
-    mach_msg_type_number_t count = VM_REGION_BASIC_INFO_COUNT_64;
-    vm_region_basic_info_data_64_t info;
-    kern_return_t info_ret = vm_region_64(task,
-                                          &address,
-                                          &size,
-                                          VM_REGION_BASIC_INFO_64,
-                                          (vm_region_info_64_t)&info,
-                                          &count,
-                                          &object);
-    if (info_ret == KERN_SUCCESS) {
-        return info.protection;
-    } else {
-        return VM_PROT_READ;
-    }
-}
-
 static void perform_rebinding_with_section(struct rebindings_entry *rebindings,
                                            section_t *section,
                                            intptr_t slide,
                                            nlist_t *symtab,
                                            char *strtab,
                                            uint32_t *indirect_symtab) {
-    const bool isDataConst = strcmp(section->segname, SEG_DATA_CONST) == 0;
     uint32_t *indirect_symbol_indices = indirect_symtab + section->reserved1;
     void **indirect_symbol_bindings = (void **)((uintptr_t)slide + section->addr);
-    vm_prot_t oldProtection = VM_PROT_READ;
-    if (isDataConst) {
-        oldProtection = get_protection(rebindings);
-        mprotect(indirect_symbol_bindings, section->size, PROT_READ | PROT_WRITE);
-    }
+
     for (uint i = 0; i < section->size / sizeof(void *); i++) {
         uint32_t symtab_index = indirect_symbol_indices[i];
         if (symtab_index == INDIRECT_SYMBOL_ABS || symtab_index == INDIRECT_SYMBOL_LOCAL ||
@@ -200,33 +174,24 @@ static void perform_rebinding_with_section(struct rebindings_entry *rebindings,
         struct rebindings_entry *cur = rebindings;
         while (cur) {
             for (uint j = 0; j < cur->rebindings_nel; j++) {
-                if (symbol_name_longer_than_1 &&
-                    strcmp(&symbol_name[1], cur->rebindings[j].name) == 0) {
-                    if (cur->rebindings[j].replaced != NULL &&
-                        indirect_symbol_bindings[i] != cur->rebindings[j].replacement) {
+                if (symbol_name_longer_than_1 && strcmp(&symbol_name[1], cur->rebindings[j].name) == 0) {
+                    if (cur->rebindings[j].replaced != NULL && indirect_symbol_bindings[i] != cur->rebindings[j].replacement) {
                         *(cur->rebindings[j].replaced) = indirect_symbol_bindings[i];
                     }
-                    indirect_symbol_bindings[i] = cur->rebindings[j].replacement;
+
+                    kern_return_t err = vm_protect(mach_task_self(), (uintptr_t)indirect_symbol_bindings, section->size, 0, VM_PROT_READ | VM_PROT_WRITE | VM_PROT_COPY);
+
+                    if (err == KERN_SUCCESS) {
+                        indirect_symbol_bindings[i] = cur->rebindings[j].replacement;
+                    }
+
                     goto symbol_loop;
                 }
             }
             cur = cur->next;
         }
     symbol_loop:;
     }
-    if (isDataConst) {
-        int protection = 0;
-        if (oldProtection & VM_PROT_READ) {
-            protection |= PROT_READ;
-        }
-        if (oldProtection & VM_PROT_WRITE) {
-            protection |= PROT_WRITE;
-        }
-        if (oldProtection & VM_PROT_EXECUTE) {
-            protection |= PROT_EXEC;
-        }
-        mprotect(indirect_symbol_bindings, section->size, protection);
-    }
 }
 
 static void rebind_symbols_for_image(struct rebindings_entry *rebindings,