Repository navigation
Conversation
Rollback netplay states may be rejected after deserialization has already modified earlier subsystems. Returning in that state can leave unvalidated indices and sizes live, including a CD-ROM sector size later passed to an unbounded FIFO copy. Reset after a failed load when no backup was requested, so partial state cannot execute. Clear CPU delayed-load register indices before SetPC() flushes the pipeline, making reset safe after a crafted partial load.
Contributor
|
Merged manually by hand |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Rollback netplay states are loaded through
retro_unserialize()without the backup used for normal state loads. A crafted state can be rejected afterSystem::DoState()has already replaced fields in earlier subsystems, leaving those rejected values live.For example,
CDROM::DoState()rejects a sector buffer size aboveRAW_SECTOR_OUTPUT_SIZE, but the oversized value remains installed. A later CD data request passes it fromCDROM::LoadDataFIFO()toFIFOQueue::PushRange(), causing out-of-bounds heap reads and writes in a connected client. A malicious netplay host can supply this state.Make
System::LoadState()reset after a failed load whenrestore_on_failureis false. This preserves the fast path for successful runahead and netplay loads while ensuring rejected partial state cannot execute.CPU::Reset()now clears delayed-load register indices beforeSetPC()flushes the pipeline, making reset safe if rejection followed a crafted CPU section.