From 4a32c051e91f65dc820323e3eeae0df46faa36eb Mon Sep 17 00:00:00 2001
From: CLARATION <claration@riseup.net>
Date: Tue, 30 Jun 2026 22:44:34 -0700
Subject: [PATCH] chore: bounds/file checks for overrides

---
 src/globals.c          | 22 ++++++++++++++++++++--
 src/m8/run.c           | 18 ++++++++++++------
 src/main.cpp           | 11 +++++++++++
 src/usb/pongo_helper.c |  6 ------
 src/usb/pongo_helper.h |  3 +++
 5 files changed, 46 insertions(+), 14 deletions(-)

diff --git a/src/globals.c b/src/globals.c
index 9eaccc8..4046b60 100644
--- a/src/globals.c
+++ b/src/globals.c
@@ -7,23 +7,41 @@
 #include <stddef.h>
 #include <string.h>
 
-#include "gen/payloads/binpack.h"
-#include "gen/payloads/ramdisk.h"
+#if WITH_BINPACK
+# include "gen/payloads/binpack.h"
+#endif
+#if WITH_RAMDISK
+# include "gen/payloads/ramdisk.h"
+#endif
 #include "gen/payloads/Pongo.h"
 #include "gen/payloads/checkra1n-kpf-pongo.h"
 
 uint64_t palerain_flags = 0;
 char boot_args[0x270] = { '\0' };
 
+#if WITH_BINPACK
 payload_t g_payload_overlay = {
     .data = payloads_binpack_dmg,
     .data_len = payloads_binpack_dmg_len,
 };
+#else
+payload_t g_payload_overlay = {
+    .data = NULL,
+    .data_len = 0,
+};
+#endif
 
+#if WITH_RAMDISK
 payload_t g_payload_ramdisk = {
     .data = payloads_ramdisk_dmg,
     .data_len = payloads_ramdisk_dmg_len,
 };
+#else
+payload_t g_payload_ramdisk = {
+    .data = NULL,
+    .data_len = 0,
+};
+#endif
 
 payload_t g_payload_pongo = {
     .data = payloads_Pongo_bin,
diff --git a/src/m8/run.c b/src/m8/run.c
index f78e410..119e148 100644
--- a/src/m8/run.c
+++ b/src/m8/run.c
@@ -161,13 +161,19 @@ static void *pongo_thread(void *arg)
 
         issue_pongo_command(&handle, "fuse lock");
         issue_pongo_command(&handle, "sep auto");
-        upload_buffer_to_pongo(&handle, g_payload_kpf.data, g_payload_kpf.data_len);
-        issue_pongo_command(&handle, "modload");
+        if (g_payload_kpf.data_len > 0) {
+            upload_buffer_to_pongo(&handle, g_payload_kpf.data, g_payload_kpf.data_len);
+            issue_pongo_command(&handle, "modload");
+        }
         issue_pongo_command(&handle, paleinfo);
-        upload_buffer_to_pongo(&handle, g_payload_ramdisk.data, g_payload_ramdisk.data_len);
-        issue_pongo_command(&handle, "ramdisk");
-        upload_buffer_to_pongo(&handle, g_payload_overlay.data, g_payload_overlay.data_len);
-        issue_pongo_command(&handle, "overlay");
+        if (g_payload_ramdisk.data_len > 0) {
+            upload_buffer_to_pongo(&handle, g_payload_ramdisk.data, g_payload_ramdisk.data_len);
+            issue_pongo_command(&handle, "ramdisk");
+        }
+        if (g_payload_overlay.data_len > 0) {
+            upload_buffer_to_pongo(&handle, g_payload_overlay.data, g_payload_overlay.data_len);
+            issue_pongo_command(&handle, "overlay");
+        }
         if (strlen(boot_args) > 0) issue_pongo_command(&handle, xargs_cmd);
         issue_pongo_command(&handle, "bootx");
 
diff --git a/src/main.cpp b/src/main.cpp
index 4994c27..eddc62b 100644
--- a/src/main.cpp
+++ b/src/main.cpp
@@ -18,6 +18,7 @@
 #ifdef _WIN32
 # include "usb/driver.h"
 #endif
+#include "usb/pongo_helper.h"
 
 void print_credits() {
     printf(
@@ -207,6 +208,10 @@ void parse_arguments(int argc, char* argv[]) {
                     LOG_ERROR("Failed to load pongo payload\n");
                     exit(1);
                 }
+                if (g_payload_pongo.data_len > PONGO_MAX_SZ) {
+                    LOG_ERROR("Pongo payload too large: %zu bytes (max %zu)", g_payload_pongo.data_len, PONGO_MAX_SZ);
+                    exit(1);
+                }
                 LOG("Overriding pongo payload with %s", optarg);
                 break;
             case 'K': // --override-kpf
@@ -214,6 +219,12 @@ void parse_arguments(int argc, char* argv[]) {
                     LOG_ERROR("Failed to load kpf payload\n");
                     exit(1);
                 }
+                if (g_payload_kpf.data_len < 4
+                    || (memcmp(g_payload_kpf.data, MACHO_MAGIC_64, 4) != 0 && memcmp(g_payload_kpf.data, MACHO_MAGIC_32, 4) != 0))
+                {
+                    LOG_ERROR("Invalid kpf payload, is it macho?");
+                    exit(1);
+                }
                 LOG("Overriding kpf payload with %s", optarg);
                 break;
             case 'o': // --override-overlay
diff --git a/src/usb/pongo_helper.c b/src/usb/pongo_helper.c
index 473b066..066fece 100644
--- a/src/usb/pongo_helper.c
+++ b/src/usb/pongo_helper.c
@@ -44,15 +44,9 @@ static bool compress_pongo(uint8_t **out, size_t *out_len)
 }
 
 #define SHELLCODE_SZ (512)
-#define PONGO_MAX_SZ (0x7fe00)
 
 bool prepare_pongo(uint8_t **out, size_t *out_len)
 {
-    if (g_payload_pongo.data_len > PONGO_MAX_SZ) {
-        LOG_ERROR("Pongo payload too large: %zu bytes (max 511 KB)", g_payload_pongo.data_len);
-        return false;
-    }
-    
     size_t pongoSize;
     uint8_t *pongo;
 
diff --git a/src/usb/pongo_helper.h b/src/usb/pongo_helper.h
index 98af6f0..b457843 100644
--- a/src/usb/pongo_helper.h
+++ b/src/usb/pongo_helper.h
@@ -3,6 +3,9 @@
 
 #include "shim.h"
 
+#define PONGO_MAX_SZ (0x7fe00)
+#define MACHO_MAGIC_32 (const unsigned char[]){ 0xCE, 0xFA, 0xED, 0xFE }
+#define MACHO_MAGIC_64 (const unsigned char[]){ 0xCF, 0xFA, 0xED, 0xFE }
 #define CMD_LENGTH_MAX 512
 
 bool prepare_pongo(uint8_t **out, size_t *out_len);