From d300181ab9301aa7374133e800d77d20c99caea0 Mon Sep 17 00:00:00 2001 From: Ryan Houdek Date: Thu, 30 Dec 2021 22:51:27 -0800 Subject: [PATCH] FEXCore: Fixes a memcpy overflow in processor brand When our FEX version string has less than 16 characters this would result in size_t underflow, resulting in a crash. This only ever occurs on a release tag so it went uncaught at first. The PPA builder managed to uncover this problem since it only deals with release tags. --- External/FEXCore/Source/Interface/Core/CPUID.cpp | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/External/FEXCore/Source/Interface/Core/CPUID.cpp b/External/FEXCore/Source/Interface/Core/CPUID.cpp index 3cd76354a..6a9aa1070 100644 --- a/External/FEXCore/Source/Interface/Core/CPUID.cpp +++ b/External/FEXCore/Source/Interface/Core/CPUID.cpp @@ -908,7 +908,7 @@ constexpr char ProcessorBrand[32] = { GIT_DESCRIBE_STRING }; -constexpr size_t DESCRIBE_STR_SIZE = std::char_traits::length(GIT_DESCRIBE_STRING); +constexpr ssize_t DESCRIBE_STR_SIZE = std::char_traits::length(GIT_DESCRIBE_STRING); static_assert(DESCRIBE_STR_SIZE < 32); //Processor brand string @@ -926,14 +926,15 @@ FEXCore::CPUID::FunctionResults CPUIDEmu::Function_8000_0004h(uint32_t Leaf) { FEXCore::CPUID::FunctionResults CPUIDEmu::Function_8000_0002h(uint32_t Leaf, uint32_t CPU) { FEXCore::CPUID::FunctionResults Res{}; - memcpy(&Res, &ProcessorBrand[0], sizeof(FEXCore::CPUID::FunctionResults)); + memset(&Res, ' ', sizeof(FEXCore::CPUID::FunctionResults)); + memcpy(&Res, &ProcessorBrand[0], DESCRIBE_STR_SIZE); return Res; } FEXCore::CPUID::FunctionResults CPUIDEmu::Function_8000_0003h(uint32_t Leaf, uint32_t CPU) { FEXCore::CPUID::FunctionResults Res{}; memset(&Res, ' ', sizeof(FEXCore::CPUID::FunctionResults)); - memcpy(&Res, &ProcessorBrand[16], DESCRIBE_STR_SIZE - 16); + memcpy(&Res, &ProcessorBrand[16], std::max(0L, DESCRIBE_STR_SIZE - 16)); return Res; }