From 51af996854ce01da17750b0a1f8d2f3a95449cfc Mon Sep 17 00:00:00 2001 From: Zach Hilman Date: Sat, 17 Nov 2018 21:40:17 -0500 Subject: [PATCH] ldr_ro: Add error check for memory allocation failure --- src/core/hle/kernel/process.cpp | 4 ++-- src/core/hle/kernel/vm_manager.cpp | 6 +++--- src/core/hle/kernel/vm_manager.h | 3 ++- src/core/hle/service/ldr/ldr.cpp | 27 ++++++++++++++++++++------- 4 files changed, 27 insertions(+), 13 deletions(-) diff --git a/src/core/hle/kernel/process.cpp b/src/core/hle/kernel/process.cpp index f06b6bb55b..a257c37269 100644 --- a/src/core/hle/kernel/process.cpp +++ b/src/core/hle/kernel/process.cpp @@ -252,8 +252,8 @@ ResultCode Process::HeapFree(VAddr target, u32 size) { return vm_manager.HeapFree(target, size); } -ResultCode Process::MirrorMemory(VAddr dst_addr, VAddr src_addr, u64 size) { - return vm_manager.MirrorMemory(dst_addr, src_addr, size); +ResultCode Process::MirrorMemory(VAddr dst_addr, VAddr src_addr, u64 size, MemoryState state) { + return vm_manager.MirrorMemory(dst_addr, src_addr, size, state); } ResultCode Process::UnmapMemory(VAddr dst_addr, VAddr /*src_addr*/, u64 size) { diff --git a/src/core/hle/kernel/vm_manager.cpp b/src/core/hle/kernel/vm_manager.cpp index ec7fd61508..100f8f6bfe 100644 --- a/src/core/hle/kernel/vm_manager.cpp +++ b/src/core/hle/kernel/vm_manager.cpp @@ -298,7 +298,7 @@ ResultCode VMManager::HeapFree(VAddr target, u64 size) { return RESULT_SUCCESS; } -ResultCode VMManager::MirrorMemory(VAddr dst_addr, VAddr src_addr, u64 size) { +ResultCode VMManager::MirrorMemory(VAddr dst_addr, VAddr src_addr, u64 size, MemoryState state) { const auto vma = FindVMA(src_addr); ASSERT_MSG(vma != vma_map.end(), "Invalid memory address"); @@ -312,8 +312,8 @@ ResultCode VMManager::MirrorMemory(VAddr dst_addr, VAddr src_addr, u64 size) { const std::shared_ptr>& backing_block = vma->second.backing_block; const std::size_t backing_block_offset = vma->second.offset + vma_offset; - CASCADE_RESULT(auto new_vma, MapMemoryBlock(dst_addr, backing_block, backing_block_offset, size, - MemoryState::Mapped)); + CASCADE_RESULT(auto new_vma, + MapMemoryBlock(dst_addr, backing_block, backing_block_offset, size, state)); // Protect mirror with permissions from old region Reprotect(new_vma, vma->second.permissions); // Remove permissions from old region diff --git a/src/core/hle/kernel/vm_manager.h b/src/core/hle/kernel/vm_manager.h index 248cc46dcd..d522404fe8 100644 --- a/src/core/hle/kernel/vm_manager.h +++ b/src/core/hle/kernel/vm_manager.h @@ -189,7 +189,8 @@ public: ResultVal HeapAllocate(VAddr target, u64 size, VMAPermission perms); ResultCode HeapFree(VAddr target, u64 size); - ResultCode MirrorMemory(VAddr dst_addr, VAddr src_addr, u64 size); + ResultCode MirrorMemory(VAddr dst_addr, VAddr src_addr, u64 size, + MemoryState state = MemoryState::Mapped); /** * Scans all VMAs and updates the page table range of any that use the given vector as backing diff --git a/src/core/hle/service/ldr/ldr.cpp b/src/core/hle/service/ldr/ldr.cpp index 5f020cbe0f..b43f1f054b 100644 --- a/src/core/hle/service/ldr/ldr.cpp +++ b/src/core/hle/service/ldr/ldr.cpp @@ -18,6 +18,7 @@ namespace Service::LDR { namespace ErrCodes { enum { + InvalidMemoryState = 51, InvalidNRO = 52, InvalidNRR = 53, MissingNRRHash = 54, @@ -32,6 +33,7 @@ enum { }; } +constexpr ResultCode ERROR_INVALID_MEMORY_STATE(ErrorModule::Loader, ErrCodes::InvalidMemoryState); constexpr ResultCode ERROR_INVALID_NRO(ErrorModule::Loader, ErrCodes::InvalidNRO); constexpr ResultCode ERROR_INVALID_NRR(ErrorModule::Loader, ErrCodes::InvalidNRR); constexpr ResultCode ERROR_MISSING_NRR_HASH(ErrorModule::Loader, ErrCodes::MissingNRRHash); @@ -120,7 +122,7 @@ public: return; } - if (nro.size() >= MAXIMUM_LOADED_RO) { + if (nrr.size() >= MAXIMUM_LOADED_RO) { LOG_ERROR(Service_LDR, "Loading new NRR would exceed the maximum number of loaded NRRs " "(0x40)! Failing..."); IPC::ResponseBuilder rb{ctx, 2}; @@ -178,10 +180,13 @@ public: } std::vector hashes; + + // Copy all hashes in the NRR (specified by hash count/hash offset) into vector. for (std::size_t i = header.hash_offset; - i < (header.hash_offset + (header.hash_count << 5)); i += 8) { - hashes.emplace_back(); - std::memcpy(hashes.back().data(), nrr_data.data() + i, sizeof(SHA256Hash)); + i < (header.hash_offset + (header.hash_count * sizeof(SHA256Hash))); i += 8) { + SHA256Hash hash; + std::memcpy(hash.data(), nrr_data.data() + i, sizeof(SHA256Hash)); + hashes.emplace_back(hash); } nrr.insert_or_assign(nrr_addr, std::move(hashes)); @@ -258,8 +263,8 @@ public: // NRO Size or BSS Size is zero or causes overflow const auto nro_size_valid = nro_size != 0 && nro_addr + nro_size > nro_addr && Common::Is4KBAligned(nro_size); - const auto bss_size_valid = std::numeric_limits::max() - nro_size >= bss_size && - (bss_size == 0 || bss_addr + bss_size > bss_addr); + const auto bss_size_valid = + nro_size + bss_size >= nro_size && (bss_size == 0 || bss_addr + bss_size > bss_addr); if (!nro_size_valid || !bss_size_valid) { LOG_ERROR(Service_LDR, @@ -313,7 +318,15 @@ public: auto& vm_manager = process->VMManager(); auto map_address = vm_manager.FindFreeRegion(nro_size + bss_size); - ASSERT(map_address.Succeeded()); + if (!map_address.Succeeded() || + *map_address + nro_size + bss_size > vm_manager.GetAddressSpaceEndAddress()) { + + LOG_ERROR(Service_LDR, + "General error while allocation memory or no available memory to allocate!"); + IPC::ResponseBuilder rb{ctx, 2}; + rb.Push(ERROR_INVALID_MEMORY_STATE); + return; + } ASSERT(process->MirrorMemory(*map_address, nro_addr, nro_size, Kernel::MemoryState::ModuleCodeStatic) == RESULT_SUCCESS);