From 8d2fa31bc96d2293561ac013971f7fbeadeb78ae Mon Sep 17 00:00:00 2001
From: CLARATION <claration@riseup.net>
Date: Sun, 2 Aug 2026 20:34:22 -0700
Subject: [PATCH] fix: do proper checks for pongo bin

---
 src/globals.c      | 23 +++++++++++++++++++++++
 src/globals.h      |  1 +
 src/main.cpp       | 22 +++++++---------------
 src/pongo_helper.h |  5 -----
 4 files changed, 31 insertions(+), 20 deletions(-)

diff --git a/src/globals.c b/src/globals.c
index b71f6ab..51ad616 100644
--- a/src/globals.c
+++ b/src/globals.c
@@ -88,6 +88,29 @@ payload_t g_payload_kpf = {
     .uncompressed_data_len = embedded_checkra1n_kpf_pongo_len,
 };
 
+#define PONGO_MAX_SZ    (0x7fe00)
+#define MACHO_MAGIC_32  (0xFEEDFACE)
+#define MACHO_MAGIC_64  (0xFEEDFACF)
+
+bool check_payload_validity(const payload_t *payload, bool isPongo)
+{
+    if (!payload || !payload->data || payload->data_len < 4)
+        return false;
+
+    const uint32_t magic = *(const uint32_t *)payload->data;
+    const bool isMachO = (magic == MACHO_MAGIC_32 || magic == MACHO_MAGIC_64);
+
+    if (isPongo) {
+        if (isMachO || payload->data_len > PONGO_MAX_SZ)
+            return false;
+    } else {
+        if (!isMachO)
+            return false;
+    }
+
+    return true;
+}
+
 bool override_payload_from_file(const char *path, payload_t *out)
 {
     FILE *f = fopen(path, "rb");
diff --git a/src/globals.h b/src/globals.h
index 1ac8083..774d8ed 100644
--- a/src/globals.h
+++ b/src/globals.h
@@ -52,6 +52,7 @@ extern payload_t g_payload_kpf;
 extern "C" {
 #endif
 
+bool check_payload_validity(const payload_t *payload, bool isPongo);
 bool override_payload_from_file(const char *path, payload_t *out);
 
 #ifdef __cplusplus
diff --git a/src/main.cpp b/src/main.cpp
index 85c7f62..d26b210 100644
--- a/src/main.cpp
+++ b/src/main.cpp
@@ -333,11 +333,10 @@ void parse_arguments(int argc, char* argv[]) {
                     LOG_ERROR("Failed to load pongo payload, is the path correct?");
                     exit(1);
                 }
-                if (g_payload_pongo.data_len > PONGO_MAX_SZ) {
-                    LOG_ERROR("Pongo payload is too large! %zu bytes (max %zu)", g_payload_pongo.data_len, PONGO_MAX_SZ);
+                if (!check_payload_validity(&g_payload_pongo, true)) {
+                    LOG_ERROR("Pongo payload is invalid or too large! %zu bytes", g_payload_pongo.data_len);
                     exit(1);
                 }
-                // TODO: check if macho, otherwise exit
                 LOG("Overriding pongo payload with %s", optarg);
                 break;
             case 'K': // --override-kpf
@@ -345,11 +344,8 @@ void parse_arguments(int argc, char* argv[]) {
                     LOG_ERROR("Failed to load kpf payload, is the path correct?");
                     exit(1);
                 }
-                if (g_payload_kpf.data_len < 4
-                    || (memcmp(g_payload_kpf.data, MACHO_MAGIC_64, 4) != 0
-                    && memcmp(g_payload_kpf.data, MACHO_MAGIC_32, 4) != 0))
-                {
-                    LOG_ERROR("Invalid kpf payload, is it macho?");
+                if (!check_payload_validity(&g_payload_kpf, false)) {
+                    LOG_ERROR("KPF payload is invalid! Is it a valid Mach-O binary?");
                     exit(1);
                 }
                 LOG("Overriding kpf payload with %s", optarg);
@@ -476,8 +472,8 @@ void parse_arguments(int argc, char* argv[]) {
             LOG_ERROR("Failed to load pongo payload from env, is the path correct?");
             exit(1);
         }
-        if (g_payload_pongo.data_len > PONGO_MAX_SZ) {
-            LOG_ERROR("Pongo payload is too large! %zu bytes (max %zu)", g_payload_pongo.data_len, PONGO_MAX_SZ);
+        if (!check_payload_validity(&g_payload_pongo, true)) {
+            LOG_ERROR("Pongo payload is invalid or too large! %zu bytes", g_payload_pongo.data_len);
             exit(1);
         }
         LOG("Overriding pongo payload with %s (from env)", env_pongo);
@@ -489,10 +485,7 @@ void parse_arguments(int argc, char* argv[]) {
             LOG_ERROR("Failed to load kpf payload from env, is the path correct?");
             exit(1);
         }
-        if (g_payload_kpf.data_len < 4
-            || (memcmp(g_payload_kpf.data, MACHO_MAGIC_64, 4) != 0
-            && memcmp(g_payload_kpf.data, MACHO_MAGIC_32, 4) != 0))
-        {
+        if (!check_payload_validity(&g_payload_kpf, false)) {
             LOG_ERROR("Invalid kpf payload from env, is it macho?");
             exit(1);
         }
@@ -517,7 +510,6 @@ void parse_arguments(int argc, char* argv[]) {
         LOG("Overriding ramdisk payload with %s (from env)", env_ramdisk);
     }
 
-
     // MARK: Flag checks
 
     if ((palerain_flags & palerain_option_pongo_exit) &&
diff --git a/src/pongo_helper.h b/src/pongo_helper.h
index b5d8bf5..5872c94 100644
--- a/src/pongo_helper.h
+++ b/src/pongo_helper.h
@@ -46,11 +46,6 @@ typedef transfer_ret_t p1_transfer_ret_t;
 typedef checkm8_err_t p1_checkm8_err_t;
 #endif
 
-#define PONGO_MAX_SZ (0x7fe00)
-// used for checking overridden files (KPF mainly)
-#define MACHO_MAGIC_32 (const unsigned char[]){ 0xCE, 0xFA, 0xED, 0xFE }
-#define MACHO_MAGIC_64 (const unsigned char[]){ 0xCF, 0xFA, 0xED, 0xFE }
-
 p1_checkm8_err_t send_compressed_pongo(p1_usb_handle_t *handle, const uint8_t *pongo_bin, const size_t pongo_bin_length);
 p1_checkm8_err_t send_full_pongo_jailbreak(p1_usb_handle_t *handle);