Fixed buffer overflow of trap table

This commit is contained in:
meepingsnesroms
2019-04-04 21:49:30 -07:00
parent 90ed900001
commit 857b4bbed3
8 changed files with 23 additions and 16 deletions

View File

@@ -838,7 +838,8 @@ uint32_t sandboxCommand(uint32_t command, void* data){
void sandboxOnOpcodeRun(void){
#if defined(EMU_SANDBOX_LOG_APIS)
logApiCalls();
if(sandboxRunning())
logApiCalls();
#endif
switch(m68k_get_reg(NULL, M68K_REG_PC)){//switched this from PPC to PC
//case 0x10083652://USB issue location //address based on PPC

View File

@@ -35,3 +35,7 @@ void clearWatchRegion(uint16_t index){
writeArbitraryMemory32(EMU_REG_ADDR(EMU_SRC), index);
writeArbitraryMemory32(EMU_REG_ADDR(EMU_CMD), CMD_DEBUG_WATCH);
}
void watchAppCode(const char* appName){
/*marks app code resources as debug watch areas*/
}

View File

@@ -18,5 +18,6 @@ void debugLog(const char* format, ...);
uint16_t setWatchRegion(uint32_t address, uint32_t size, uint8_t type);
void clearWatchRegion(uint16_t index);
void watchAppCode(const char* appName);
#endif

View File

@@ -7,7 +7,7 @@
#define NO_RETURN __attribute__((noreturn))
#define ALIGN(size) __attribute__((aligned(size)))
#define PACKED __attribute__((packed))
#define FIXED_ADDRESS_VAR(a, t) (*((volatile t*)a))
#define FIXED_ADDRESS_VAR(a, t) (*((t volatile *)a))
#define readArbitraryMemory8(address) (*((volatile uint8_t*)(address)))
#define readArbitraryMemory16(address) (*((volatile uint16_t*)(address)))

View File

@@ -13,7 +13,7 @@
#define ResetVector FIXED_ADDRESS_VAR(0x00000004, void*)
/*OS*/
#define TrapTablePtr FIXED_ADDRESS_VAR(0x00000122, uint32_t*)
#define TrapTablePtr FIXED_ADDRESS_VAR(0x00000122, void**)
#define ScrStatePtr FIXED_ADDRESS_VAR(0x00000164, void*)
#endif

View File

@@ -30,14 +30,15 @@ static void lockCodeXXXX(void){
static void resizeTrapTable(void){
uint16_t oldSr;
uint32_t* oldTrapTable;
uint32_t* newTrapTable;
void** oldTrapTable;
void** newTrapTable;
/*order and time sensitive code!!!*/
oldSr = SysDisableInts();
/*get new trap table memory*/
newTrapTable = MemChunkNew(0, (sysTrapLastTrapNumber - sysTrapBase) * sizeof(uint32_t), memNewChunkFlagPreLock | memNewChunkFlagNonMovable | memNewChunkFlagAllowLarge);
debugLog("New trap table created at:0x%08lX\n", newTrapTable);
/*copy over old OS 4 size trap table and 0 out the OS 5 part*/
MemMove(newTrapTable, TrapTablePtr, (sysTrapPceNativeCall - sysTrapBase) * sizeof(uint32_t));
@@ -49,8 +50,7 @@ static void resizeTrapTable(void){
/*swap the tables*/
TrapTablePtr = newTrapTable;
/*free the old table*/
MemChunkFree(oldTrapTable);
/*cant free the old table as it is in low mem globals out of the jurisdiction of the memory manager*/
/*return to normal execution*/
SysRestoreStatus(oldSr);
@@ -88,7 +88,7 @@ static void installPceNativeCallHandler(uint32_t armStackSize){
uint8_t* oldArmStack = (uint8_t*)getGlobalVar(ARM_STACK_START);
uint8_t* armStackStart;
SysSetTrapAddress(sysTrapPceNativeCall, (void*)emuPceNativeCall);
TrapTablePtr[sysTrapPceNativeCall - sysTrapBase] = (void*)emuPceNativeCall;
if(oldArmStack)
MemChunkFree(oldArmStack);
@@ -111,9 +111,9 @@ static void installDebugHandlers(void){
/*eventually should remove the NULL check too, the trap list should have no NULL values*/
if(trapAddress == sysUnimplementedAddress || trapAddress == NULL)
SysSetTrapAddress(index, (void*)emuSysUnimplemented);
TrapTablePtr[index - sysTrapBase] = (void*)emuSysUnimplemented;
}
SysSetTrapAddress(sysTrapErrDisplayFileLineMsg, (void*)emuErrDisplayFileLineMsg);
TrapTablePtr[sysTrapErrDisplayFileLineMsg - sysTrapBase] = (void*)emuErrDisplayFileLineMsg;
}
static void setProperDeviceId(uint16_t screenWidth, uint16_t screenHeight, Boolean hasArmCpu, Boolean hasDpad){
@@ -248,6 +248,10 @@ void initBoot(uint32_t* configFile){
/*prevents the code being moved out from underneath its function pointers(in the API trap table), causing crashes*/
lockCodeXXXX();
/*make an OS 5 size trap table, needed if debugging or any OS 5 features are enabled*/
if(enabledFeatures & (FEATURE_HYBRID_CPU | FEATURE_SND_STRMS | FEATURE_DEBUG))
resizeTrapTable();
if(enabledFeatures & FEATURE_DEBUG)
installDebugHandlers();
@@ -272,7 +276,3 @@ void initBoot(uint32_t* configFile){
writeConfigFile(configFile);
}
}
void reinit(uint32_t* configFile){
/*TODO*/
}

View File

@@ -4,6 +4,5 @@
#include <stdint.h>
void initBoot(uint32_t* configFile);
void reinit(uint32_t* configFile);
#endif

View File

@@ -11,7 +11,9 @@ For some reason the new versions of MuExpDriver dont work with Chuzzle anymore
Need to allocate a new trap table and set the global to that, not just write off the end of the existing one
Need to lock the code resources on boot, databases can be shuffled in RAM to free up space and that will corrupt old trap addresses
Need to patch SysGetOSVersionString
Crash on first load when pressing "Emulator", probably caused by accessing the config file wrong
Crash on first load when pressing "Emulator", probably caused by accessing the config file wrong(happens after driver is deleted and reinstalled)
Debug memory tools watchAppCode() is unfinished
Now that the low memory global space for the trap table is unused I have a place for global vars
Fixed:
GUI