fix(profiling): mask local/abs symbol flags and bounds check Mach-O tables

Author: realFlowControl

profiling/src/io/got_macho.rs

@@ -327,8 +327,9 @@ unsafe fn rebind_symbols_for_image(
                     // file. At runtime, __LINKEDIT is mapped at (vmaddr + slide). By subtracting
                     // the file offset of __LINKEDIT itself, we get a base we can add any file
                     // offset to in order to get a valid runtime pointer.
-                    linkedit_base =
-                        (slide as usize).wrapping_add(seg.vmaddr as usize) - seg.fileoff as usize;
+                    linkedit_base = (slide as usize)
+                        .wrapping_add(seg.vmaddr as usize)
+                        .wrapping_sub(seg.fileoff as usize);
                     linkedit_found = true;
                 }
             }
@@ -390,7 +391,10 @@ unsafe fn rebind_symbols_for_image(
                         slide,
                         symtab,
                         strtab,
+                        (*symtab_cmd).nsyms as usize,
+                        (*symtab_cmd).strsize as usize,
                         indirect_symtab,
+                        (*dysymtab_cmd).nindirectsyms as usize,
                         overwrites,
                         segname == "__DATA_CONST",
                     ) {
@@ -422,7 +426,10 @@ unsafe fn rebind_symbols_in_section(
     slide: isize,
     symtab: *const Nlist64,
     strtab: *const c_char,
+    nsyms: usize,
+    strsize: usize,
     indirect_symtab: *const u32,
+    nindirectsyms: usize,
     overwrites: &mut [GotSymbolOverwrite],
     is_data_const: bool,
 ) -> bool {
@@ -432,7 +439,14 @@ unsafe fn rebind_symbols_in_section(
 
     // The indirect symbol table entries for this section start at index `section.reserved1`.
     // Entry `indirect_sym_indices[i]` tells us which symbol table entry corresponds to slot `i`.
-    let indirect_sym_indices = indirect_symtab.add(section.reserved1 as usize);
+    let indirect_sym_start = section.reserved1 as usize;
+    let Some(indirect_sym_end) = indirect_sym_start.checked_add(num_indirect_syms) else {
+        return false;
+    };
+    if indirect_sym_end > nindirectsyms {
+        return false;
+    }
+    let indirect_sym_indices = indirect_symtab.add(indirect_sym_start);
 
     // The actual pointer slots in memory (adjusted by ASLR slide).
     let symbol_ptrs = ((slide as usize).wrapping_add(section.addr as usize)) as *mut *mut c_void;
@@ -445,19 +459,27 @@ unsafe fn rebind_symbols_in_section(
         let symtab_index = *indirect_sym_indices.add(i);
 
         // Skip special entries that don't refer to real external symbols
-        if symtab_index == INDIRECT_SYMBOL_LOCAL
-            || symtab_index == INDIRECT_SYMBOL_ABS
-            || symtab_index == (INDIRECT_SYMBOL_LOCAL | INDIRECT_SYMBOL_ABS)
-        {
+        if (symtab_index & (INDIRECT_SYMBOL_LOCAL | INDIRECT_SYMBOL_ABS)) != 0 {
+            continue;
+        }
+
+        if symtab_index as usize >= nsyms {
             continue;
         }
 
         // Step 2: Look up the symbol in the symbol table to get its name
         let nlist = &*symtab.add(symtab_index as usize);
-        let name_ptr = strtab.add(nlist.n_strx as usize);
-        let name = match CStr::from_ptr(name_ptr).to_str() {
-            Ok(n) => n,
-            Err(_) => continue,
+        let name_offset = nlist.n_strx as usize;
+        if name_offset >= strsize {
+            continue;
+        }
+        let name_bytes =
+            std::slice::from_raw_parts(strtab.add(name_offset) as *const u8, strsize - name_offset);
+        let Ok(name) = CStr::from_bytes_until_nul(name_bytes) else {
+            continue;
+        };
+        let Ok(name) = name.to_str() else {
+            continue;
         };
 
         // Step 3: Strip the Mach-O leading underscore (e.g. "_recv" → "recv") so we can