Technical Analysis of the Pegasus Exploits on iOS

deserialized, <strong>the</strong> object’s reference count is decremented by calling o->release(), which will
lead to <strong>the</strong> object being free()ed in most cases. The exception to this behavior occurs within
kOSSerializeObject objects.
Since a kOSSerializeObject object represents an object that is referenced by o<strong>the</strong>r entries,
it is necessary to retain <strong>the</strong> object after serialization. As a result, during deserialization
kOSSerializeObject objects will call o->retain(), <strong>the</strong>reby incrementing <strong>the</strong> reference
count for <strong>the</strong> object and preventing its removal from memory.
A serialized data blob allows for <strong>the</strong> same key to be used more than once. In o<strong>the</strong>r words, it is
possible to have XML code that looks like:
KEY1
1
KEY1
2
The above XML, once serialized, will contain five objects. The first object will be <strong>the</strong> dictionary
container ( as a kOSSerializeDictionary object), followed by a symbol
representing <strong>the</strong> key (as a kOSSerializeSymbol entry containing “KEY1”) and its data object
(a kOSSerializeNumber entry for <strong>the</strong> integer 1). The fourth entry specifies ano<strong>the</strong>r key
object, assigned KEY1 again, which is now a string object (kOSSerializeString) containing
<strong>the</strong> string “2”. As part <strong>of</strong> <strong>the</strong> deserialization process, <strong>the</strong> reuse <strong>of</strong> KEY1 results in <strong>the</strong> object that
follows replacing <strong>the</strong> original value assigned to KEY1. This reassignment <strong>of</strong> a key with new data
is <strong>the</strong> situation where OSUnserializeBinary is vulnerable to attack.
As stated previously, when an object is deserialized, and so long as that object is not a
kOSSerializeObject, <strong>the</strong> object is stored in <strong>the</strong> objsArray for later reference. This
storage is <strong>the</strong> result <strong>of</strong> <strong>the</strong> setAtIndex macro seen here:
#define setAtIndex(v, idx, o) \
if (idx >= v##Capacity) \
{ \
uint32_t ncap = v##Capacity + 64; \
type<strong>of</strong>(v##Array) nbuf = (type<strong>of</strong>(v##Array)) kalloc_container(ncap * size<strong>of</strong>(o)); \
if (!nbuf) ok = false; \
if (v##Array) \
{ \
bcopy(v##Array, nbuf, v##Capacity * size<strong>of</strong>(o)); \
kfree(v##Array, v##Capacity * size<strong>of</strong>(o)); \
} \
v##Array = nbuf; \
v##Capacity = ncap; \
} \
if (ok) v##Array[idx] = o;
Page 27