Calls that checked one byte of a game's buffer and then wrote or read the
whole thing, or trusted a negative length:
- sceNetEtherNtostr/Strton, the apctl BSS descriptor calls, GetState and
sceNetGetDropRate.
- sceNpAuthGetTicket wrote its whole ticket whatever the length; it's
now built locally and written once the buffer is known to hold it.
sceNpAuthGetTicketParam checked its limits after copying, and walked
ticket params past the ticket's end.
- sceNp2's communication ID and passphrase, a negative maxServerIds, and
an unchecked unknown1Ptr.
- sceParseUri's work area and scheme string, sceParseHttp's negative
header length and value address, and ReadVariableSizedStruct's size.
- sceKernelCreateLwMutex initialized the work area without checking it
at all, and the other LwMutex calls checked one byte of it.
- sceNetAdhocctlGetScanInfo cleared the length the game gave, of a
buffer checked by one byte (or any length, negative ones included).
Also: a game mode join inserted at begin() + 1 into a possibly empty
list of players.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- The apctl, NpAuth and NpMatching2 event loops kept references to the
front of their deque after popping it, so callbacks could get the
next event's arguments. NpMatching2 also dereferenced its optional
opt param when it was null.
- The resolver was left stopped after any savestate load or reboot,
which broke Outrun 2006 (it relies on it starting out running).
- Getpeername/Getsockname with a namelen under 2 copied a negative size.
They now write the PSP's 16-byte sockaddr truncated to namelen, with
sa_len 16, as pspautotests net/inet/poll shows on hardware.
- Poll handed an fd that isn't open (-1) to FD_SET. It now reports
POLLNVAL for it and counts it, as on hardware (net/inet/poll).
Setsockopt read past a local u32 for larger options, and passed a
negative optlen to the host. A zero cmsg_len looped forever.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
HLEFunc and ReplaceFunc now take the MIPSState they run on. The dispatch
paths (both interpreters and every JIT backend) pass in the state they
belong to, and CallSyscall*, hleFinishSyscall and the HLE mips call
machinery use it instead of currentMIPS.
The wrappers in FunctionWrappers.h take the function as `auto` and call it
through HLECall, which also accepts an implementation with an extra leading
MIPSState * parameter and passes the state to it. Any other signature still
fails to compile, as before. PARAM/RETURN now refer to a local `mips`.
The HLE functions (and replacement functions) that used currentMIPS now take
the state that way. Callers outside a syscall's own frame - CoreTiming
events, the adhoc matching thread, dialogs, PPGe, the debugger UIs - pass
currentMIPS or &mipsr4k explicitly. The kernel's thread internals still use
currentMIPS.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* Rename LogType to Log
* Explicitly use the Log:: enum when logging. Allows for autocomplete when editing.
* Mac/ARM64 buildfix
* Do the same with the hle result log macros
* Rename the log names to mixed case while at it.
* iOS buildfix
* Qt buildfix attempt, ARM32 buildfix
