We already had code to close open host files when reading or writing a
savestate, but due to d35fe1b we also need to close open guest files
when reading a savestate, otherwise DoStateRead fails to delete them.
I was considering an alternative solution where instead of copying and
clearing m_handles, we just set `handle.opened = false;` for each handle
before reading a savestate (but not before writing a savestate).
However, this wouldn't solve the problem of DoStateWriteOrMeasure's
calls to OpenFile failing due to all handles being open. I'm not aware
of any games that have that many handles open, though.
Log each rejected ELF header, range, and symbol reference. This
provides actionable diagnostics for malformed files without changing the
validation behavior.
ElfReader trusted table offsets and counts from standalone ELF files.
Malformed input could make it read and write past the loaded file buffer.
Validate the ELF header, table ranges, segment data, section data, and
string-table references before accessing them. Invalid files use the
existing executable boot failure path.
NetPlay save synchronization decoded remote LZO blocks with the unsafe
decoder and no output capacity. A malicious host could overflow a client
buffer with a block larger than its declared size.
Use the bounds-checking decoder, validate the declared output length, and
grow buffer results only after each checked block has been decoded.
A malicious dol could theoretically use integer wraparound to bypass
bounds checking and cause DolReader to read past the end of m_bytes.
Could result in crashes, wasting large amounts of memory, or even the
disclosure of heap memory contents.
A malicious GCZ file could probably force this to be negative.
Shouldn't cause any issues other than file read failures, but need to fix
because it is causing errors on MSVC.
SectorReader::ReadChunk does do some validation on it, but it only
checks against the original disc size (reported by the GCZ file).
It has no idea how many blocks the header claimed the disc had.
A maliciously crafted GCZ file could trigger read overflows off the end
of the m_block_pointers/m_hashes arrays.
Independently spotted by both @Dentomologist and me while reviewing
PR #14805
The previous limit was correct for valid VPBs, but an invalid VPB
controlled by a malicious game could contain a non-fractional value
in current_pos_frac, which would allow writing an extra 15 samples
(30 bytes) into the stack. With AFC encoding, this is rounded up to 16
samples, but with much less control over which bytes are written.
Maybe we should be doing some validation, or bounds checking, but I'm
pretty sure this issue was copied from the original ucode, and we kinda
want to stay compatible.
The simpler fix is to just increase the size of raw_input_samples.
I've checked other code paths, and 0x514 samples seems to be the limit.
This change was causing some issues:
> Made FMT_STRING a no-op when FMT_USE_CONSTEVAL is enabled, since the consteval format-string constructor already provides compile-time validation (#4611, #4612). Thanks @friedkeenan.
We had some code in VolumeVerifier to catch the error message that
Redump.org used to show when trying to access the Wii datfile without
logging in. This restriction was removed from Redump.org around the
start of 2022, and the code has been unnecessary ever since.
When we added the RetroAchievements integration, we had a discussion
about whether sending version information in the user agent was fine
from a privacy standpoint. We reached the conclusion that it was okay,
but it was conditional on the website having a privacy policy. Neither
incarnation of Redump has that, and Redump also never asked us to send
version information like RetroAchievements did, so let's use a user
agent that just says "Dolphin" when connecting to Redump.
All the staff of Redump (except the absentee sysadmin) have decided to
start a new version of the website at redump.info. It has every disc
from the old site, it has HTTPS, it isn't buckling under the load of AI
scrapers, and moving forward, all adding and verifying of discs is going
to be happening on the new website only. Let's move over.
I've taken the unusual step of updating the translation files manually.
This is because we're very close to a release and because the change is
simple enough that I feel confident about making the change to languages
I don't speak. (I double checked that the Korean translation doesn't
ever follow "Redump.org" by a particle that has a different form
depending on whether there's a final consonant.)
This makes us savestate the NAND using the same APIs the guest uses
instead of directly touching the host files. This solves several
problems:
* If the user loaded a malicious savestate, it could use path traversal
to overwrite arbitrary files on the host file system. (Reported by
MrSynAckster.)
* Metadata (UID, GID, attribute, modes) wasn't being savestated.
* NAND redirects weren't handled, except for NAND redirects at the root
of where the savestate was being done. (This only possibly matters if
TASing a Riivolution patch. The root of the savestate is at /tmp when
not TASing, and the only case where we do a NAND redirect is inside
/title if requested by a Riivolution patch.)
The conditions were in reverse order (maybe someone was reading the
PowerPC manual and forgot about IBM's bit numbering), and additionally
the two conditions for unsigned comparison were wrong.
Fixes https://bugs.dolphin-emu.org/issues/14054.
Reported by MrSynAckster. A specifically crafted NAND dump could use
path traversal to overwrite files on the host file system.
This is also an accuracy fix for importing NAND dumps that contain
file names that Dolphin is supposed to escape. Some games' save files
are affected.
GetPath has two special cases where it doesn't add a slash.
The first is for the root entry's special name "/". The next commit will
be neater if we can skip calling GetPath for the root entry, because '/'
is one of the characters that Common::EscapeFileName replaces with an
escape sequence. Let's check for entry number 0 instead.
The second is for parent paths that already end in a slash. There's no
actual need to check for this - double slashes are harmless, and for
comparison, NANDImporter::ExtractCertificates already appends slashes
without checking if there already is one. Let's remove this check.
