citra-emu
/
citra-canary
Archived
1
0
Fork 0
Code

service/cecd: Fix buffer writes in ReadData. (#6880)

This commit is contained in:
Steveice10 2023-08-11 10:31:24 -07:00 committed by GitHub
parent eb8d2941c9
commit a27971e723
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 11 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
src/core/hle/service/cecd/cecd.cpp
View File

@ -620,9 +620,9 @@ void Module::Interface::SetData(Kernel::HLERequestContext& ctx) {
void Module::Interface::ReadData(Kernel::HLERequestContext& ctx) {
IPC::RequestParser rp(ctx);
const u32 dest_buffer_size = rp.Pop<u32>();
const CecSystemInfoType info_type = rp.PopEnum<CecSystemInfoType>();
const u32 param_buffer_size = rp.Pop<u32>();
const auto dest_buffer_size = rp.Pop<u32>();
const auto info_type = rp.PopEnum<CecSystemInfoType>();
const auto param_buffer_size = rp.Pop<u32>();
auto& param_buffer = rp.PopMappedBuffer();
auto& dest_buffer = rp.PopMappedBuffer();
@ -631,22 +631,23 @@ void Module::Interface::ReadData(Kernel::HLERequestContext& ctx) {
std::vector<u8> buffer;
switch (info_type) {
case CecSystemInfoType::EulaVersion: {
auto cfg = Service::CFG::GetModule(cecd->system);
Service::CFG::EULAVersion version = cfg->GetEULAVersion();
dest_buffer.Write(&version, 0, sizeof(version));
const auto cfg = Service::CFG::GetModule(cecd->system);
const auto version = cfg->GetEULAVersion();
buffer = {version.minor, version.major};
break;
}
case CecSystemInfoType::Eula:
buffer = {0x01}; // Eula agreed
dest_buffer.Write(buffer.data(), 0, buffer.size());
buffer = {true}; // Eula agreed
break;
case CecSystemInfoType::ParentControl:
buffer = {0x00}; // No parent control
dest_buffer.Write(buffer.data(), 0, buffer.size());
buffer = {false}; // No parent control
break;
default:
LOG_ERROR(Service_CECD, "Unknown system info type={:#x}", info_type);
buffer = {};
}
dest_buffer.Write(buffer.data(), 0,
std::min(static_cast<size_t>(dest_buffer_size), buffer.size()));
rb.Push(RESULT_SUCCESS);
rb.PushMappedBuffer(param_buffer);