We already had code to close open host files when reading or writing a
savestate, but due to d35fe1b we also need to close open guest files
when reading a savestate, otherwise DoStateRead fails to delete them.
I was considering an alternative solution where instead of copying and
clearing m_handles, we just set `handle.opened = false;` for each handle
before reading a savestate (but not before writing a savestate).
However, this wouldn't solve the problem of DoStateWriteOrMeasure's
calls to OpenFile failing due to all handles being open. I'm not aware
of any games that have that many handles open, though.
Log each rejected ELF header, range, and symbol reference. This
provides actionable diagnostics for malformed files without changing the
validation behavior.
ElfReader trusted table offsets and counts from standalone ELF files.
Malformed input could make it read and write past the loaded file buffer.
Validate the ELF header, table ranges, segment data, section data, and
string-table references before accessing them. Invalid files use the
existing executable boot failure path.
NetPlay save synchronization decoded remote LZO blocks with the unsafe
decoder and no output capacity. A malicious host could overflow a client
buffer with a block larger than its declared size.
Use the bounds-checking decoder, validate the declared output length, and
grow buffer results only after each checked block has been decoded.
A malicious dol could theoretically use integer wraparound to bypass
bounds checking and cause DolReader to read past the end of m_bytes.
Could result in crashes, wasting large amounts of memory, or even the
disclosure of heap memory contents.
This makes us savestate the NAND using the same APIs the guest uses
instead of directly touching the host files. This solves several
problems:
* If the user loaded a malicious savestate, it could use path traversal
to overwrite arbitrary files on the host file system. (Reported by
MrSynAckster.)
* Metadata (UID, GID, attribute, modes) wasn't being savestated.
* NAND redirects weren't handled, except for NAND redirects at the root
of where the savestate was being done. (This only possibly matters if
TASing a Riivolution patch. The root of the savestate is at /tmp when
not TASing, and the only case where we do a NAND redirect is inside
/title if requested by a Riivolution patch.)
The conditions were in reverse order (maybe someone was reading the
PowerPC manual and forgot about IBM's bit numbering), and additionally
the two conditions for unsigned comparison were wrong.
Fixes https://bugs.dolphin-emu.org/issues/14054.
SendGameStatus() was writing SyncIdentifierComparison as a u32 but the server reads it as a u8 enum, so the server always gets 0 (SameGame). This bug was introduced in commit 66276ac.
Remove the [[maybe_unused]] annotation from various parameters that are
unconditionally unused and comment out their names instead. This makes
it unambiguous that the variables are unused, while making the remaining
[[maybe_unused]] annotations more reliable indicators that those
variables are in fact used in some contexts.
These parameters are mostly in overridden functions where the override
doesn't need that particular variable.
This fixes VolumeVerifier potentially calling TMDReader::GetIOSId for
invalid TMDs.
VolumeVerifier also has a call to TMDReader::GetContent that doesn't
check if the TMD is valid. In practice, this can't get called with an
invalid TMD because the previous commit made it so GetContentOffsets
returns an empty vector if the TMD is invalid, but I've added a check
inside TMDReader::GetContent just to be on the safe side.
I also made VolumeVerifier show a specifically worded problem if the
ticket or TMD is invalid. Before, invalid TMDs in Wii discs and WADs
and invalid tickets in WADs would show a more generic problem.
