Calls that checked one byte of a game's buffer and then wrote or read the
whole thing, or trusted a negative length:
- sceNetEtherNtostr/Strton, the apctl BSS descriptor calls, GetState and
sceNetGetDropRate.
- sceNpAuthGetTicket wrote its whole ticket whatever the length; it's
now built locally and written once the buffer is known to hold it.
sceNpAuthGetTicketParam checked its limits after copying, and walked
ticket params past the ticket's end.
- sceNp2's communication ID and passphrase, a negative maxServerIds, and
an unchecked unknown1Ptr.
- sceParseUri's work area and scheme string, sceParseHttp's negative
header length and value address, and ReadVariableSizedStruct's size.
- sceKernelCreateLwMutex initialized the work area without checking it
at all, and the other LwMutex calls checked one byte of it.
- sceNetAdhocctlGetScanInfo cleared the length the game gave, of a
buffer checked by one byte (or any length, negative ones included).
Also: a game mode join inserted at begin() + 1 into a possibly empty
list of players.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- The apctl, NpAuth and NpMatching2 event loops kept references to the
front of their deque after popping it, so callbacks could get the
next event's arguments. NpMatching2 also dereferenced its optional
opt param when it was null.
- The resolver was left stopped after any savestate load or reboot,
which broke Outrun 2006 (it relies on it starting out running).
- Getpeername/Getsockname with a namelen under 2 copied a negative size.
They now write the PSP's 16-byte sockaddr truncated to namelen, with
sa_len 16, as pspautotests net/inet/poll shows on hardware.
- Poll handed an fd that isn't open (-1) to FD_SET. It now reports
POLLNVAL for it and counts it, as on hardware (net/inet/poll).
Setsockopt read past a local u32 for larger options, and passed a
negative optlen to the host. A zero cmsg_len looped forever.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Rename LogType to Log
* Explicitly use the Log:: enum when logging. Allows for autocomplete when editing.
* Mac/ARM64 buildfix
* Do the same with the hle result log macros
* Rename the log names to mixed case while at it.
* iOS buildfix
* Qt buildfix attempt, ARM32 buildfix
