preserve-emulation/ppsspp
1
0
Fork 0
mirror of https://github.com/hrydgard/ppsspp.git synced 2026-09-03 11:15:20 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fix OOB read on unterminated module names in PRX import debug reporter

Browse Source 
The import debug reporter used IsValidAddress (start-address only) before
formatting module names with %s, so a crafted unterminated name could be
read past guest RAM. Use IsValidNullTerminatedString instead.
This commit is contained in:
Henrik Rydgård
2026-08-01 11:57:27 +02:00
parent 2100e4ec47
commit 983068b07a
1 changed files with 5 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Core/HLE/sceKernelModule.cpp
+5 -3
View File
@@ -835,8 +835,8 @@ static bool KernelImportModuleFuncs(PSPModule *module, u32 *firstImportStubAddr,
entryPos += entry->size;
const char *modulename;
if (Memory::IsValidAddress(entry->name)) {
modulename = Memory::GetCharPointer(entry->name);
if (Memory::IsValidNullTerminatedString(entry->name)) {
modulename = Memory::GetCharPointerUnchecked(entry->name);
} else {
modulename = "(invalidname)";
needReport = true;
@@ -932,7 +932,9 @@ static bool KernelImportModuleFuncs(PSPModule *module, u32 *firstImportStubAddr,
char temp[512];
const char *modulename;
if (Memory::IsValidAddress(entry->name)) {
// Check for NUL termination within the mapped region so %s below
// can't read past guest RAM on a crafted, unterminated name.
if (Memory::IsValidNullTerminatedString(entry->name)) {
modulename = Memory::GetCharPointerUnchecked(entry->name);
} else {
modulename = "(invalidname)";