OpenPunk/citra
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

service/cecd: Fix buffer writes in ReadData. (#6880)

Browse Source
This commit is contained in:
Steveice10
2023-08-11 10:31:24 -07:00
committed by GitHub
parent eb8d2941c9
commit a27971e723
1 changed files with 11 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
src/core/hle/service/cecd/cecd.cpp
View File

@@ -620,9 +620,9 @@ void Module::Interface::SetData(Kernel::HLERequestContext& ctx) {
void Module::Interface::ReadData(Kernel::HLERequestContext& ctx) { void Module::Interface::ReadData(Kernel::HLERequestContext& ctx) {
IPC::RequestParser rp(ctx); IPC::RequestParser rp(ctx);
const u32 dest_buffer_size = rp.Pop<u32>(); const auto dest_buffer_size = rp.Pop<u32>();
const CecSystemInfoType info_type = rp.PopEnum<CecSystemInfoType>(); const auto info_type = rp.PopEnum<CecSystemInfoType>();
const u32 param_buffer_size = rp.Pop<u32>(); const auto param_buffer_size = rp.Pop<u32>();
auto& param_buffer = rp.PopMappedBuffer(); auto& param_buffer = rp.PopMappedBuffer();
auto& dest_buffer = rp.PopMappedBuffer(); auto& dest_buffer = rp.PopMappedBuffer();
@@ -631,22 +631,23 @@ void Module::Interface::ReadData(Kernel::HLERequestContext& ctx) {
std::vector<u8> buffer; std::vector<u8> buffer;
switch (info_type) { switch (info_type) {
case CecSystemInfoType::EulaVersion: { case CecSystemInfoType::EulaVersion: {
auto cfg = Service::CFG::GetModule(cecd->system); const auto cfg = Service::CFG::GetModule(cecd->system);
Service::CFG::EULAVersion version = cfg->GetEULAVersion(); const auto version = cfg->GetEULAVersion();
dest_buffer.Write(&version, 0, sizeof(version)); buffer = {version.minor, version.major};
break; break;
} }
case CecSystemInfoType::Eula: case CecSystemInfoType::Eula:
buffer = {0x01}; // Eula agreed buffer = {true}; // Eula agreed
dest_buffer.Write(buffer.data(), 0, buffer.size());
break; break;
case CecSystemInfoType::ParentControl: case CecSystemInfoType::ParentControl:
buffer = {0x00}; // No parent control buffer = {false}; // No parent control
dest_buffer.Write(buffer.data(), 0, buffer.size());
break; break;
default: default:
LOG_ERROR(Service_CECD, "Unknown system info type={:#x}", info_type); LOG_ERROR(Service_CECD, "Unknown system info type={:#x}", info_type);
buffer = {};
} }
dest_buffer.Write(buffer.data(), 0,
std::min(static_cast<size_t>(dest_buffer_size), buffer.size()));
rb.Push(RESULT_SUCCESS); rb.Push(RESULT_SUCCESS);
rb.PushMappedBuffer(param_buffer); rb.PushMappedBuffer(param_buffer);