preserve-emulation/ppsspp
1
0 Fork 0
mirror of https://github.com/hrydgard/ppsspp.git synced 2026-10-18 17:00:30 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fix OOB read on unterminated module names in PRX import debug reporter

Browse Source 
The import debug reporter used IsValidAddress (start-address only) before
formatting module names with %s, so a crafted unterminated name could be
read past guest RAM. Use IsValidNullTerminatedString instead.
This commit is contained in:
Henrik Rydgård committed 2026-08-01 11:57:27 +02:00
1 parent 2100e4ec47
commit 983068b07a
1 file changed
+5 -3
Download Patch File Download Diff File Expand all files Collapse all files
Core/HLE/sceKernelModule.cpp
+5 -3
View File
@@ -835,8 +835,8 @@ static bool KernelImportModuleFuncs(PSPModule *module, u32 *firstImportStubAddr,
entryPos += entry->size;
const char *modulename;
if (Memory::IsValidAddress(entry->name)) {
modulename = Memory::GetCharPointer(entry->name);
if (Memory::IsValidNullTerminatedString(entry->name)) {
modulename = Memory::GetCharPointerUnchecked(entry->name);
} else {
modulename = "(invalidname)";
needReport = true;
@@ -932,7 +932,9 @@ static bool KernelImportModuleFuncs(PSPModule *module, u32 *firstImportStubAddr,
char temp[512];
const char *modulename;
if (Memory::IsValidAddress(entry->name)) {
// Check for NUL termination within the mapped region so %s below
// can't read past guest RAM on a crafted, unterminated name.
if (Memory::IsValidNullTerminatedString(entry->name)) {
modulename = Memory::GetCharPointerUnchecked(entry->name);
} else {
modulename = "(invalidname)";