Skip to content

Commit 94a6ca3

Browse files
committed
MetadataReader: Fix reading obfuscated tagged pointers
Turns out the tags are shuffled around by XORing with a per-process hash, and we have to deobfuscate the tag before checking if its an extended tag. There's no test for this; just running the existing tests several times in a row is sufficient to trigger the problem.
1 parent 28f305b commit 94a6ca3

File tree

1 file changed

+7
-3
lines changed

1 file changed

+7
-3
lines changed

include/swift/Remote/MetadataReader.h

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -202,6 +202,7 @@ class MetadataReader {
202202
StoredPointer TaggedPointerExtendedSlotShift;
203203
StoredPointer TaggedPointerExtendedSlotMask;
204204
StoredPointer TaggedPointerExtendedClasses;
205+
StoredPointer TaggedPointerObfuscator;
205206

206207
Demangle::NodeFactory Factory;
207208

@@ -711,7 +712,7 @@ class MetadataReader {
711712
if (getTaggedPointerEncoding() != TaggedPointerEncodingKind::Extended)
712713
return false;
713714

714-
return objectAddress & TaggedPointerMask;
715+
return (objectAddress ^ TaggedPointerObfuscator) & TaggedPointerMask;
715716
}
716717

717718
/// Read the isa pointer of an Object-C tagged pointer value.
@@ -728,8 +729,8 @@ class MetadataReader {
728729

729730
// Extended pointers have a tag of 0b111, using 8 additional bits
730731
// to specify the class.
731-
if (TaggedPointerExtendedMask != 0 &&
732-
((objectAddress & TaggedPointerExtendedMask)
732+
if (TaggedPointerExtendedMask != 0 &&
733+
(((objectAddress ^ TaggedPointerObfuscator) & TaggedPointerExtendedMask)
733734
== TaggedPointerExtendedMask)) {
734735
auto tag = ((objectAddress >> TaggedPointerExtendedSlotShift) &
735736
TaggedPointerExtendedSlotMask);
@@ -2436,6 +2437,9 @@ class MetadataReader {
24362437
TaggedPointerExtendedClasses =
24372438
TaggedPointerExtendedClassesAddr.getAddressData();
24382439

2440+
tryFindAndReadSymbol(TaggedPointerObfuscator,
2441+
"objc_debug_taggedpointer_obfuscator");
2442+
24392443
# undef tryFindSymbol
24402444
# undef tryReadSymbol
24412445
# undef tryFindAndReadSymbol

0 commit comments

Comments
 (0)