Calls that checked one byte of a game's buffer and then wrote or read the
whole thing, or trusted a negative length:
- sceNetEtherNtostr/Strton, the apctl BSS descriptor calls, GetState and
sceNetGetDropRate.
- sceNpAuthGetTicket wrote its whole ticket whatever the length; it's
now built locally and written once the buffer is known to hold it.
sceNpAuthGetTicketParam checked its limits after copying, and walked
ticket params past the ticket's end.
- sceNp2's communication ID and passphrase, a negative maxServerIds, and
an unchecked unknown1Ptr.
- sceParseUri's work area and scheme string, sceParseHttp's negative
header length and value address, and ReadVariableSizedStruct's size.
- sceKernelCreateLwMutex initialized the work area without checking it
at all, and the other LwMutex calls checked one byte of it.
- sceNetAdhocctlGetScanInfo cleared the length the game gave, of a
buffer checked by one byte (or any length, negative ones included).
Also: a game mode join inserted at begin() + 1 into a possibly empty
list of players.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
HLEFunc and ReplaceFunc now take the MIPSState they run on. The dispatch
paths (both interpreters and every JIT backend) pass in the state they
belong to, and CallSyscall*, hleFinishSyscall and the HLE mips call
machinery use it instead of currentMIPS.
The wrappers in FunctionWrappers.h take the function as `auto` and call it
through HLECall, which also accepts an implementation with an extra leading
MIPSState * parameter and passes the state to it. Any other signature still
fails to compile, as before. PARAM/RETURN now refer to a local `mips`.
The HLE functions (and replacement functions) that used currentMIPS now take
the state that way. Callers outside a syscall's own frame - CoreTiming
events, the adhoc matching thread, dialogs, PPGe, the debugger UIs - pass
currentMIPS or &mipsr4k explicitly. The kernel's thread internals still use
currentMIPS.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
sceUriParse's size query (no parsed-URI or work area) returns 0 on a PSP, not -1,
which made Wipeout Pure's embedded browser give up before connecting. And
sceHttpGetAllHeader hands out the header block as received, ending with the blank
line, NUL-terminated and with the NUL counted; without the blank line the browser
never displayed the image the page consists of. Both from the 6.60 firmware
modules (libparse_uri.prx, libhttp.prx).
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Add the missing functions to sceHttp
Create sceOpenPSID and add what jpcsp is doing
Create sceParseHttp.cpp
Create sceParseUri.cpp
Create sceSsl.cpp and add what jpcsp is doing
reindent some files.
in an attempt to try and get a few games doing more.
