SIGSEGV when scanning macOS 14.4.1 IPSW

[nmggithub]

What happened?

I was attempting to scan an IPSW file and the command line utility crashed in the middle of scanning.

How can we reproduce this?

1. Download macOS IPSW file from here: https://ipsw.me/download/Mac15,9/23E224
2. Run ipsw macho search ~/Downloads/UniversalMac_14.4.1_23E224_Restore.ipsw -m "sqlite3_step"
3. Observe crash

...
0x55bc: /System/Library/Frameworks/Ruby.framework/Versions/2.6/usr/lib/ruby/gems/2.6.0/gems/sqlite3-1.3.13/ext/sqlite3/sqlite3_native.bundle        ()      _rb_sqlite3_step
0x388: /System/Library/Frameworks/Ruby.framework/Versions/2.6/usr/lib/ruby/gems/2.6.0/gems/sqlite3-1.3.13/ext/sqlite3/sqlite3_native.bundle (_sqlite3_step)
0x55bc: /System/Library/Frameworks/Ruby.framework/Versions/2.6/usr/lib/ruby/gems/2.6.0/gems/sqlite3-1.3.13/lib/sqlite3/sqlite3_native.bundle        ()      _rb_sqlite3_step
0x388: /System/Library/Frameworks/Ruby.framework/Versions/2.6/usr/lib/ruby/gems/2.6.0/gems/sqlite3-1.3.13/lib/sqlite3/sqlite3_native.bundle (_sqlite3_step)
0x0: /System/Library/Frameworks/Security.framework/Versions/A/XPCServices/authd.xpc/Contents/MacOS/authd    (external|undefined)    _sqlite3_step
0x0: /System/Library/Frameworks/StoreKit.framework/Support/storekitagent    (external|undefined)    _sqlite3_step
0x0: /System/Library/Input Methods/AinuIM.app/Contents/MacOS/AinuIM (external|undefined)    _sqlite3_step
0x0: /System/Library/Input Methods/CharacterPalette.app/Contents/MacOS/CharacterPalette     (external|undefined)    _sqlite3_step
panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x2 addr=0x30 pc=0x103303020]

goroutine 1 [running]:
github.com/blacktop/ipsw/cmd/ipsw/cmd/macho.init.func14.1({0x1400967fb1c, 0x3b}, 0x14006b3e140)
        github.com/blacktop/ipsw/cmd/ipsw/cmd/macho/macho_search.go:235 +0xfe0
github.com/blacktop/ipsw/internal/search.scanDmg.func4({0x1400967fb00, 0x57}, 0x14000849bc8, {0x14004841e40, 0x1c})
        github.com/blacktop/ipsw/internal/search/search.go:89 +0x198
github.com/blacktop/ipsw/internal/search.scanDmg({0x16d9977b2, 0x3d}, {0x140001a89d8, 0x11}, {0x10406ec4a, 0xa}, 0x14000849bc8)
        github.com/blacktop/ipsw/internal/search/search.go:94 +0x5c8
github.com/blacktop/ipsw/internal/search.ForEachMachoInIPSW({0x16d9977b2, 0x3d}, 0x14000849bc8)
        github.com/blacktop/ipsw/internal/search/search.go:112 +0xcc
github.com/blacktop/ipsw/cmd/ipsw/cmd/macho.init.func14(0x105467900?, {0x140006d5c20, 0x1, 0x10405ba83?})
        github.com/blacktop/ipsw/cmd/ipsw/cmd/macho/macho_search.go:131 +0x4c8
github.com/spf13/cobra.(*Command).execute(0x105467900, {0x140006d5bc0, 0x3, 0x3})
        github.com/spf13/[email protected]/command.go:983 +0x840
github.com/spf13/cobra.(*Command).ExecuteC(0x1054428c0)
        github.com/spf13/[email protected]/command.go:1115 +0x344
github.com/spf13/cobra.(*Command).Execute(...)
        github.com/spf13/[email protected]/command.go:1039
github.com/blacktop/ipsw/cmd/ipsw/cmd.Execute()
        github.com/blacktop/ipsw/cmd/ipsw/cmd/root.go:67 +0x24
main.main()
        github.com/blacktop/ipsw/cmd/ipsw/main.go:27 +0x1c

ipsw version

Version: 3.1.480, BuildCommit: 2fffe45e5437a6f0ac4527edc4336fb80d853bbb

Search

• I did search for other open and closed issues before opening this

Code of Conduct

• I agree to follow this project's Code of Conduct

Additional context

No response

[blacktop]

sorry for the long delay, I have pushed out a fix and will cut a new release soon.

thank you for reporting!

[nmggithub]

sorry for the long delay, I have pushed out a fix and will cut a new release soon.

thank you for reporting!

You're welcome! And thank you. Please do note that this happens pretty consistently for me regardless of what symbol I search for. Looking at the commit message, though, it appears your fix is a general one (but I wanted to make sure you knew this was a widespread issue). I apologize for not mentioning that explicitly in my original post.

[blacktop]

ya this fix should fix for macho's that don't have a symtab. are you saying that this type of error happens on other commands?

I have pushed out the fix in a release. if this fixes your issue feel free to close the issue 👍

[nmggithub]

Sorry, to clarify again, this error only happens when searching for symbols, but it's not only searching for sqlite3_step symbol that produces the error. Searching for any symbol produces the error. However, the update does appear to have solved it, so I will close this issue. I will open a new one if the error reappears.