Fix crash in StuffItX parser when block size overflows

[alek-prykhodko]

Summary

When extracting StuffItX archives, the decompression block size is read from the compressed stream as a uint64_t via CSInputNextSitxP2, then immediately cast to unsigned int. In malformed archives this value can exceed INT_MAX, causing the cast to overflow and produce a wrong blocksize. A second overflow occurs when computing the allocation size: blocksize*6 is evaluated in unsigned int arithmetic before being passed to malloc(), and wraps around to a small value. malloc succeeds with that undersized buffer, but sorted and table are computed using the original blocksize as an offset — placing them far outside the allocation and turning any access through them into a crash:

  Exception Type:  EXC_BAD_ACCESS (KERN_INVALID_ADDRESS)
  Exception Codes: Exception 1, Code 1, Subcode 16100407620

  Thread Crashed:
        0  XADMaster    -[XADStuffItXIronHandle decodeBlockWithLength:]
        1  XADMaster    -[XADStuffItXIronHandle produceBlockAtOffset:]
        2  XADMaster    -[XADBlockStreamHandle _readNextBlock]
        3  XADMaster    -[XADBlockStreamHandle streamAtMost:toBuffer:]
        4  XADMaster    -[XADStreamHandle readAtMost:toBuffer:]
        5  XADMaster    -[XADUnarchiver runExtractorWithDictionary:outputTarget:selector:argument:]

Key Changes

• Validate the raw block size against UINT_MAX before casting to unsigned int.
• Compute the allocation size as size_t allocsize = (size_t)blocksize * 6 so the multiplication happens in 64-bit arithmetic and cannot overflow.

[Copilot]

Pull request overview

Fixes a crash in the StuffItX “Iron” decompressor caused by integer truncation/overflow when reading a malformed block size from the compressed stream.

Changes:

• Reads the block size as uint64_t and validates it before narrowing to unsigned int.
• Computes the allocation size using size_t and uses that value for malloc().

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (1)

XADStuffItXIronHandle.m:115

• table is derived from block + 2*blocksize and cast to uint32_t *. If blocksize is not 2-byte aligned, this can produce a misaligned uint32_t * (undefined behavior and potential crash on alignment-sensitive architectures). Consider aligning the table offset to alignof(uint32_t) and adjusting the allocation size accordingly.

		block=malloc(allocsize);
		if(!block) [XADException raiseOutOfMemoryException];
		sorted=block+blocksize;
		table=(uint32_t *)(block+2*blocksize);
		currsize=blocksize;