From cbe8c922a4e05fc478153f5085b947400f10d175 Mon Sep 17 00:00:00 2001 From: AdamN <7974720+anr2me@users.noreply.github.com> Date: Fri, 10 Jan 2025 22:25:25 +0700 Subject: [PATCH 1/3] Fix potential buffer size issue on sceNetInetGetpeername --- Core/HLE/sceNetInet.cpp | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/Core/HLE/sceNetInet.cpp b/Core/HLE/sceNetInet.cpp index 489da3096c..5593ed1ac7 100644 --- a/Core/HLE/sceNetInet.cpp +++ b/Core/HLE/sceNetInet.cpp @@ -133,6 +133,7 @@ static int sceNetInetGetpeername(int socket, u32 namePtr, u32 namelenPtr) { // TODO: Should've created convertSockaddrPSP2Host (and Host2PSP too) function as it's being used pretty often, thus fixing a bug on it will be tedious when scattered all over the places saddr.addr.sa_family = name->sa_family; int len = std::min(*namelen > 0 ? *namelen : 0, static_cast(sizeof(saddr))); + name->sa_len = len; memcpy(saddr.addr.sa_data, name->sa_data, sizeof(name->sa_data)); int retval = getpeername(inetSock->sock, (sockaddr*)&saddr, (socklen_t*)&len); @@ -142,8 +143,8 @@ static int sceNetInetGetpeername(int socket, u32 namePtr, u32 namelenPtr) { inetLastErrno = socket_errno; return hleLogError(Log::sceNet, retval, "errno = %d", inetLastErrno); } else { - memcpy(name->sa_data, saddr.addr.sa_data, len - (sizeof(name->sa_len) + sizeof(name->sa_family))); - name->sa_len = len; + // FIXME: We shouldn't use the returned len here, because the returned len is the actual size needed, which can be larger than the inputted len + memcpy(name->sa_data, saddr.addr.sa_data, name->sa_len - (sizeof(name->sa_len) + sizeof(name->sa_family))); name->sa_family = saddr.addr.sa_family; } return 0; From ec99cb47bd83b3fccc93a4f709201ce393cfa694 Mon Sep 17 00:00:00 2001 From: AdamN <7974720+anr2me@users.noreply.github.com> Date: Fri, 10 Jan 2025 22:38:30 +0700 Subject: [PATCH 2/3] Fix potential buffer size issue on sceNetInetGetsockname --- Core/HLE/sceNetInet.cpp | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/Core/HLE/sceNetInet.cpp b/Core/HLE/sceNetInet.cpp index 5593ed1ac7..b30868ec38 100644 --- a/Core/HLE/sceNetInet.cpp +++ b/Core/HLE/sceNetInet.cpp @@ -167,7 +167,9 @@ static int sceNetInetGetsockname(int socket, u32 namePtr, u32 namelenPtr) { SockAddrIN4 saddr{}; saddr.addr.sa_family = name->sa_family; int len = std::min(*namelen > 0 ? *namelen : 0, static_cast(sizeof(saddr))); + name->sa_len = len; memcpy(saddr.addr.sa_data, name->sa_data, sizeof(name->sa_data)); + int retval = getsockname(inetSock->sock, (sockaddr*)&saddr, (socklen_t*)&len); DEBUG_LOG(Log::sceNet, "Getsockname: Family = %s, Address = %s, Port = %d", inetSocketDomain2str(saddr.addr.sa_family).c_str(), ip2str(saddr.in.sin_addr).c_str(), ntohs(saddr.in.sin_port)); *namelen = len; @@ -175,8 +177,8 @@ static int sceNetInetGetsockname(int socket, u32 namePtr, u32 namelenPtr) { inetLastErrno = socket_errno; return hleLogError(Log::sceNet, retval, "errno = %d", inetLastErrno); } else { - memcpy(name->sa_data, saddr.addr.sa_data, len - (sizeof(name->sa_len) + sizeof(name->sa_family))); - name->sa_len = len; + // FIXME: We shouldn't use the returned len here, because the returned len is the actual size needed, which can be larger than the inputted len + memcpy(name->sa_data, saddr.addr.sa_data, name->sa_len - (sizeof(name->sa_len) + sizeof(name->sa_family))); name->sa_family = saddr.addr.sa_family; } return 0; From c5e1ea71e0fe8c1e41fa708da100aaa4da47fd8c Mon Sep 17 00:00:00 2001 From: AdamN <7974720+anr2me@users.noreply.github.com> Date: Sat, 11 Jan 2025 09:24:39 +0700 Subject: [PATCH 3/3] oops --- Core/HLE/sceNetInet.cpp | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Core/HLE/sceNetInet.cpp b/Core/HLE/sceNetInet.cpp index b30868ec38..5197e31df7 100644 --- a/Core/HLE/sceNetInet.cpp +++ b/Core/HLE/sceNetInet.cpp @@ -143,7 +143,7 @@ static int sceNetInetGetpeername(int socket, u32 namePtr, u32 namelenPtr) { inetLastErrno = socket_errno; return hleLogError(Log::sceNet, retval, "errno = %d", inetLastErrno); } else { - // FIXME: We shouldn't use the returned len here, because the returned len is the actual size needed, which can be larger than the inputted len + // We shouldn't use the returned len here, because the returned len is the actual size needed, which can be larger than the inputted len memcpy(name->sa_data, saddr.addr.sa_data, name->sa_len - (sizeof(name->sa_len) + sizeof(name->sa_family))); name->sa_family = saddr.addr.sa_family; } @@ -177,7 +177,7 @@ static int sceNetInetGetsockname(int socket, u32 namePtr, u32 namelenPtr) { inetLastErrno = socket_errno; return hleLogError(Log::sceNet, retval, "errno = %d", inetLastErrno); } else { - // FIXME: We shouldn't use the returned len here, because the returned len is the actual size needed, which can be larger than the inputted len + // We shouldn't use the returned len here, because the returned len is the actual size needed, which can be larger than the inputted len memcpy(name->sa_data, saddr.addr.sa_data, name->sa_len - (sizeof(name->sa_len) + sizeof(name->sa_family))); name->sa_family = saddr.addr.sa_family; }