Compare commits

..
Author SHA1 Message Date
OatmealDome c77bbaa0f3 ScmRevGen: Bump version to 2606a 2026-08-10 22:54:32 -04:00
OatmealDome 7345c016c9 BuildMacOSUniversalBinary: Add flag to enable CCache 2026-08-10 22:47:44 -04:00
JosJuiceandOatmealDome d3c420c6a4 IOS/FS: Fix loading savestate when files are open
We already had code to close open host files when reading or writing a
savestate, but due to d35fe1b we also need to close open guest files
when reading a savestate, otherwise DoStateRead fails to delete them.

I was considering an alternative solution where instead of copying and
clearing m_handles, we just set `handle.opened = false;` for each handle
before reading a savestate (but not before writing a savestate).
However, this wouldn't solve the problem of DoStateWriteOrMeasure's
calls to OpenFile failing due to all handles being open. I'm not aware
of any games that have that many handles open, though.
2026-08-10 22:47:44 -04:00
Acts1631andOatmealDome 5ea9d7f8a3 Core: log invalid ELF input
Log each rejected ELF header, range, and symbol reference. This
provides actionable diagnostics for malformed files without changing the
validation behavior.
2026-08-10 22:47:44 -04:00
Acts1631andOatmealDome 40cdf26dc6 Core: validate standalone ELF input ranges
ElfReader trusted table offsets and counts from standalone ELF files.
Malformed input could make it read and write past the loaded file buffer.

Validate the ELF header, table ranges, segment data, section data, and
string-table references before accessing them. Invalid files use the
existing executable boot failure path.
2026-08-10 22:47:43 -04:00
Acts1631andOatmealDome 47bb60e564 NetPlay: bound LZO decompression output
NetPlay save synchronization decoded remote LZO blocks with the unsafe
decoder and no output capacity. A malicious host could overflow a client
buffer with a block larger than its declared size.

Use the bounds-checking decoder, validate the declared output length, and
grow buffer results only after each checked block has been decoded.
2026-08-10 22:47:43 -04:00
Scott MansellandOatmealDome 690b51b396 DolReader: Fix integer wraparound
A malicious dol could theoretically use integer wraparound to bypass
bounds checking and cause DolReader to read past the end of m_bytes.

Could result in crashes, wasting large amounts of memory, or even the
disclosure of heap memory contents.
2026-08-10 22:47:43 -04:00
DacoTacoandOatmealDome 1496e7a06c fixes: make dolreader validate section addresses and sizes
IOS and IPL reject non-32byte aligned sections
2026-08-10 22:47:43 -04:00
Scott MansellandOatmealDome 289ff60cc2 GCZ: use 64-bit for m_data_offset
A malicious GCZ file could probably force this to be negative.
Shouldn't cause any issues other than file read failures, but need to fix
because it is causing errors on MSVC.
2026-08-10 22:47:43 -04:00
Scott MansellandOatmealDome fe4b08bc37 GCZ: validate while loading 2026-08-10 22:47:43 -04:00
Scott MansellandOatmealDome 22f15fbb97 GCZ: Don't trust block_num either
SectorReader::ReadChunk does do some validation on it, but it only
checks against the original disc size (reported by the GCZ file).
It has no idea how many blocks the header claimed the disc had.

A maliciously crafted GCZ file could trigger read overflows off the end
of the m_block_pointers/m_hashes arrays.
2026-08-10 22:47:43 -04:00
Scott MansellandOatmealDome 7bcf78b7ea GCZ: Don't trust GetBlockCompressedSize
It comes unverified from the file, and a maliciously crafted file could
trigger not one, but two buffer overflows in the heap.
2026-08-10 22:47:42 -04:00
Admiral H. CurtissandOatmealDome 87d5e731af IOS/NetIPTopDevice: Zero-initialize sockaddr structs
Fixes https://github.com/dolphin-emu/dolphin/security/advisories/GHSA-5fqv-9qrg-gm4j
2026-08-10 22:47:42 -04:00
Scott MansellandOatmealDome 74857b28bb Fix stack overflow in ZeldaHLE
Independently spotted by both @Dentomologist and me while reviewing
PR #14805
The previous limit was correct for valid VPBs, but an invalid VPB
controlled by a malicious game could contain a non-fractional value
in current_pos_frac, which would allow writing an extra 15 samples
(30 bytes) into the stack. With AFC encoding, this is rounded up to 16
samples, but with much less control over which bytes are written.

Maybe we should be doing some validation, or bounds checking, but I'm
pretty sure this issue was copied from the original ucode, and we kinda
want to stay compatible.

The simpler fix is to just increase the size of raw_input_samples.
I've checked other code paths, and 0x514 samples seems to be the limit.
2026-08-10 22:47:42 -04:00
Tillmann KarrasandOatmealDome 5888eb6eb6 DSPHLE/Zelda: prevent out-of-bounds stack read
Reported by @RickdeJager.
2026-08-10 22:47:42 -04:00
Admiral H. CurtissandOatmealDome 44dd6aad30 HW/DSPHLE/AXVoice: Prefer BitCastPtr over BitCastToArray in ApplyUpdatesForMs() 2026-08-10 22:47:42 -04:00
Admiral H. CurtissandOatmealDome 02f2a23f89 HW/DSPHLE/AXVoice: Check array bounds in ApplyUpdatesForMs()
Fixes https://github.com/dolphin-emu/dolphin/security/advisories/GHSA-4q28-hhjv-hf3f
2026-08-10 22:47:41 -04:00
+10 -3
View File
@@ -1468,9 +1468,16 @@ void ZeldaAudioRenderer::LoadInputSamples(MixingBuffer* buffer, VPB* vpb)
// the end of processing, if needed.
//
// Maximum of 0x500 samples here - see NeededRawSamplesCount to understand
// this practical limit (resampling_ratio = 0xFFFF -> 0x500 samples). Add a
// margin of 4 that is needed for samples source that do resampling.
std::array<s16, 0x500 + 4> raw_input_samples;
// this practical limit (resampling_ratio = 0xFFFF -> 0x500 samples).
//
// If current_pos_frac contains an (invalid) non-fractional part, it can push
// this up by another 15 samples. Which DownloadAFCSamplesFromARAM then rounds
// up to the next multiple of 16. So add an extra 0x10 samples to be safe.
//
// Plus we need an extra four samples at the start to hold the last four
// samples from the previous frame.
std::array<s16, 4 + 0x500 + 0x10> raw_input_samples;
for (size_t i = 0; i < 4; ++i)
raw_input_samples[i] = vpb->resample_buffer[i];