dahjah/pcsx2
1
0
Fork 0
mirror of https://github.com/PCSX2/pcsx2.git synced 2025-12-16 04:08:48 +00:00
Code Issues Actions 8 Packages Projects Releases Wiki Activity

GSDumpReplayer: Fix possible memcpy out of bounds read and fix different size implicit casting warnings

Browse Source
This commit is contained in:
Ty 2025-10-25 12:55:15 -04:00 committed by Ty
parent e4c1dc2359
commit 26a68ef76a
1 changed files with 14 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
pcsx2/GSDumpReplayer.cpp
View File

@ -213,16 +213,18 @@ static void GSDumpReplayerLoadInitialState()
Host::ReportFormattedErrorAsync("GSDumpReplayer", "Failed to load GS state.");
}
static void GSDumpReplayerSendPacketToMTGS(GIF_PATH path, const u8* data, u32 length)
static void GSDumpReplayerSendPacketToMTGS(GIF_PATH path, const u8* data, size_t length)
{
pxAssert((length % 16) == 0);
pxAssert((length % 16) == 0 && length < UINT32_MAX);
const u32 truncated_length = static_cast<u32>(length);
Gif_Path& gifPath = gifUnit.gifPath[path];
gifPath.CopyGSPacketData(const_cast<u8*>(data), length);
gifPath.CopyGSPacketData(const_cast<u8*>(data), truncated_length);
GS_Packet gsPack;
gsPack.offset = gifPath.curOffset;
gsPack.size = length;
gsPack.size = truncated_length;
gifPath.curOffset += length;
Gif_AddCompletedGSPacket(gsPack, path);
}
@ -248,7 +250,7 @@ static void GSDumpReplayerFrameLimit()
const s64 ms = GetTickFrequency() / 1000;
const s64 sleep = s_next_frame_time - now - ms;
if (sleep > ms)
Threading::Sleep(sleep / ms);
Threading::Sleep(static_cast<s32>(sleep / ms));
while ((now = GetCPUTicks()) < s_next_frame_time)
ShortSpin();
s_next_frame_time = std::max(now, s_next_frame_time + s_frame_ticks);
@ -284,8 +286,13 @@ void GSDumpReplayerCpuStep()
{
case GSDumpTypes::GSTransferPath::Path1Old:
{
if(packet.length > 16384)
{
Console.Error("GSDumpReplayer: Path1Old transfer exceeds 16KB buffer. Skipping transfer");
break;
}
std::unique_ptr<u8[]> data(new u8[16384]);
const s32 addr = 16384 - packet.length;
const size_t addr = 16384 - packet.length;
std::memcpy(data.get(), packet.data + addr, packet.length);
GSDumpReplayerSendPacketToMTGS(GIF_PATH_1, data.get(), packet.length);
}
@ -332,7 +339,7 @@ void GSDumpReplayerCpuStep()
case GSDumpTypes::GSType::Registers:
{
std::memcpy(PS2MEM_GS, packet.data, std::min<s32>(packet.length, Ps2MemSize::GSregs));
std::memcpy(PS2MEM_GS, packet.data, std::min<s32>(static_cast<u32>(packet.length), Ps2MemSize::GSregs));
}
break;
}