From 31eaf1d67c11f4f0036c198b2b1a7bc11c8dec5a Mon Sep 17 00:00:00 2001 From: JosJuice Date: Sat, 30 May 2026 15:50:06 +0200 Subject: [PATCH 1/2] EXI/BBA: Fix tx_fifo memory safety issues Reported by MrSynAckster. --- Source/Core/Core/HW/EXI/EXI_DeviceEthernet.cpp | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/Source/Core/Core/HW/EXI/EXI_DeviceEthernet.cpp b/Source/Core/Core/HW/EXI/EXI_DeviceEthernet.cpp index c49c6e32b9..631913f2d5 100644 --- a/Source/Core/Core/HW/EXI/EXI_DeviceEthernet.cpp +++ b/Source/Core/Core/HW/EXI/EXI_DeviceEthernet.cpp @@ -435,7 +435,11 @@ void CEXIETHERNET::DirectFIFOWrite(const u8* data, u32 size) // GMAC instead of finagling with packet descriptors and such u16* tx_fifo_count = (u16*)&mBbaMem[BBA_TXFIFOCNT]; - memcpy(tx_fifo.get() + *tx_fifo_count, data, size); + if (*tx_fifo_count < BBA_TXFIFO_SIZE) + { + const u32 max_size = BBA_TXFIFO_SIZE - *tx_fifo_count; + memcpy(tx_fifo.get() + *tx_fifo_count, data, std::min(size, max_size)); + } *tx_fifo_count += size; // TODO: not sure this mask is correct. @@ -447,7 +451,7 @@ void CEXIETHERNET::DirectFIFOWrite(const u8* data, u32 size) void CEXIETHERNET::SendFromDirectFIFO() { const u8* frame = tx_fifo.get(); - const u16 size = Common::BitCastPtr(&mBbaMem[BBA_TXFIFOCNT]); + const u16 size = std::min(BBA_TXFIFO_SIZE, Common::BitCastPtr(&mBbaMem[BBA_TXFIFOCNT])); if (m_network_interface->SendFrame(frame, size)) m_system.GetPowerPC().GetDebugInterface().NetworkLogger()->LogBBA(frame, size); } From 95f3f8c6df290ec57b9dafa245ae716ebddd64ac Mon Sep 17 00:00:00 2001 From: JosJuice Date: Sun, 31 May 2026 07:56:06 +0200 Subject: [PATCH 2/2] EXI/BBA: Add null check in CEXIETHERNET::DirectFIFOWrite Just in case. DMAWrite calls DirectFIFOWrite with the result of a GetPointerForRange call without first checking if it's null. --- Source/Core/Core/HW/EXI/EXI_DeviceEthernet.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Source/Core/Core/HW/EXI/EXI_DeviceEthernet.cpp b/Source/Core/Core/HW/EXI/EXI_DeviceEthernet.cpp index 631913f2d5..f1aa756fa7 100644 --- a/Source/Core/Core/HW/EXI/EXI_DeviceEthernet.cpp +++ b/Source/Core/Core/HW/EXI/EXI_DeviceEthernet.cpp @@ -435,7 +435,7 @@ void CEXIETHERNET::DirectFIFOWrite(const u8* data, u32 size) // GMAC instead of finagling with packet descriptors and such u16* tx_fifo_count = (u16*)&mBbaMem[BBA_TXFIFOCNT]; - if (*tx_fifo_count < BBA_TXFIFO_SIZE) + if (data != nullptr && *tx_fifo_count < BBA_TXFIFO_SIZE) { const u32 max_size = BBA_TXFIFO_SIZE - *tx_fifo_count; memcpy(tx_fifo.get() + *tx_fifo_count, data, std::min(size, max_size));