Repository navigation
Validate pad transfer state when loading savestates - #189
Merged
Merged
Conversation
Savestates can supply an out-of-range multitap transfer index, which the all-controller path uses to access its fixed response buffer. Analog controllers also restore commands without the transient state required to execute them. Validate and reset invalid multitap state, finish transfers at the buffer boundary, and discard incomplete analog command state after loading. This prevents crafted states from causing out-of-bounds accesses or division by zero during later pad traffic.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
HostInterface::retro_unserialize()passes rollback states throughSystem::LoadState()intoPad::DoState().Multitap::DoState()restoredm_controller_transfer_stepwithout checking it against the 32-byte transfer buffer.Multitap::Transfer()subsequently used it for both reads and writes. A crafted netplay rollback state could therefore crash the frontend or corrupt adjacent host memory on the next pad transfer.AnalogController::DoState()andNeGconRumble::DoState()also restored an active command without restoring its command step, response length, or response buffers. A crafted state could enter an active command with a zero response length and cause division by zero inTransfer().Validate multitap transfer state and reset it before rejecting invalid values. End all-controller responses based on the transfer buffer length rather than derived slot state. Since the analog controller state format does not contain the transient fields needed to resume an in-progress command, reset that command state after loading while preserving the controller configuration.