[MachO] Fix relocations from chained fixups not respecting addends

The addends were correctly stored in the relocation info and displayed
as offsets in linear view, but the relocation handlers never applied
them. Reading from an address containing such a relocation would give an
incorrect value.

3 files changed, 7 insertions, 7 deletions

diff --git a/arch/arm64/arch_arm64.cpp b/arch/arm64/arch_arm64.cpp
index fb623e4e..b71e79e8 100644
--- a/arch/arm64/arch_arm64.cpp
+++ b/arch/arm64/arch_arm64.cpp
@@ -2787,8 +2787,8 @@ class Arm64MachoRelocationHandler : public RelocationHandler
 		// printf("reloc->GetAddress(): 0x%llX\n", reloc->GetAddress());
 
 		if (info.nativeType == BINARYNINJA_MANUAL_RELOCATION)
-		{  // Magic number defined in MachOView.cpp for tagged pointers
-			*(uint64_t*)dest = info.target;
+		{  // Magic number defined in MachOView.cpp for chained fixups
+			*(uint64_t*)dest = info.target + info.addend;
 		}
 		else if (info.nativeType == ARM64_RELOC_PAGE21)
 		{
diff --git a/arch/armv7/arch_armv7.cpp b/arch/armv7/arch_armv7.cpp
index fdd1bad7..f9fc250e 100644
--- a/arch/armv7/arch_armv7.cpp
+++ b/arch/armv7/arch_armv7.cpp
@@ -2684,8 +2684,8 @@ public:
 	{
 		auto info = reloc->GetInfo();
 		if (info.nativeType == BINARYNINJA_MANUAL_RELOCATION)
-		{  // Magic number defined in MachOView.cpp for tagged pointers
-			*(uint32_t*)dest = (uint32_t)info.target;
+		{  // Magic number defined in MachOView.cpp for chained fixups
+			*(uint32_t*)dest = (uint32_t)(info.target + info.addend);
 		}
 
 		return true;
diff --git a/arch/x86/arch_x86.cpp b/arch/x86/arch_x86.cpp
index a79163da..f639040e 100644
--- a/arch/x86/arch_x86.cpp
+++ b/arch/x86/arch_x86.cpp
@@ -4117,10 +4117,10 @@ public:
 		case (uint64_t)-1: // Magic number defined in MachOView.cpp
 			// We need to write a jump absolute `jmp target`
 			dest[0] = '\xe9';
-			((uint32_t*)&dest[1])[0] = target - (uint32_t)reloc->GetAddress() - 5;
+			((uint32_t*)&dest[1])[0] = target + (uint32_t)info.addend - (uint32_t)reloc->GetAddress() - 5;
 			break;
 		case (uint64_t)-2: // Magic number defined in MachOView.cpp
-			dest32[0] = target;
+			dest32[0] = target + (uint32_t)info.addend;
 			break;
 		case GENERIC_RELOC_VANILLA:
 			switch (info.size)
@@ -4307,7 +4307,7 @@ public:
 			dest64[0] = dest64[0] + info.next->target - target;
 			break;
 		case (uint64_t) -2:
-			dest64[0] = reloc->GetTarget();
+			dest64[0] = info.target + info.addend;
 			break;
 		}
 		return true;