From a27971e72331d11f171b4adb8ffc365c21da1fbc Mon Sep 17 00:00:00 2001
From: Steveice10 <1269164+Steveice10@users.noreply.github.com>
Date: Fri, 11 Aug 2023 10:31:24 -0700
Subject: [PATCH] service/cecd: Fix buffer writes in ReadData. (#6880)

---
 src/core/hle/service/cecd/cecd.cpp | 21 +++++++++++----------
 1 file changed, 11 insertions(+), 10 deletions(-)

diff --git a/src/core/hle/service/cecd/cecd.cpp b/src/core/hle/service/cecd/cecd.cpp
index c1e0d446a..2daa1116c 100644
--- a/src/core/hle/service/cecd/cecd.cpp
+++ b/src/core/hle/service/cecd/cecd.cpp
@@ -620,9 +620,9 @@ void Module::Interface::SetData(Kernel::HLERequestContext& ctx) {
 
 void Module::Interface::ReadData(Kernel::HLERequestContext& ctx) {
     IPC::RequestParser rp(ctx);
-    const u32 dest_buffer_size = rp.Pop<u32>();
-    const CecSystemInfoType info_type = rp.PopEnum<CecSystemInfoType>();
-    const u32 param_buffer_size = rp.Pop<u32>();
+    const auto dest_buffer_size = rp.Pop<u32>();
+    const auto info_type = rp.PopEnum<CecSystemInfoType>();
+    const auto param_buffer_size = rp.Pop<u32>();
     auto& param_buffer = rp.PopMappedBuffer();
     auto& dest_buffer = rp.PopMappedBuffer();
 
@@ -631,22 +631,23 @@ void Module::Interface::ReadData(Kernel::HLERequestContext& ctx) {
     std::vector<u8> buffer;
     switch (info_type) {
     case CecSystemInfoType::EulaVersion: {
-        auto cfg = Service::CFG::GetModule(cecd->system);
-        Service::CFG::EULAVersion version = cfg->GetEULAVersion();
-        dest_buffer.Write(&version, 0, sizeof(version));
+        const auto cfg = Service::CFG::GetModule(cecd->system);
+        const auto version = cfg->GetEULAVersion();
+        buffer = {version.minor, version.major};
         break;
     }
     case CecSystemInfoType::Eula:
-        buffer = {0x01}; // Eula agreed
-        dest_buffer.Write(buffer.data(), 0, buffer.size());
+        buffer = {true}; // Eula agreed
         break;
     case CecSystemInfoType::ParentControl:
-        buffer = {0x00}; // No parent control
-        dest_buffer.Write(buffer.data(), 0, buffer.size());
+        buffer = {false}; // No parent control
         break;
     default:
         LOG_ERROR(Service_CECD, "Unknown system info type={:#x}", info_type);
+        buffer = {};
     }
+    dest_buffer.Write(buffer.data(), 0,
+                      std::min(static_cast<size_t>(dest_buffer_size), buffer.size()));
 
     rb.Push(RESULT_SUCCESS);
     rb.PushMappedBuffer(param_buffer);