Skip to content

Commit

Permalink
Fixed stack memory corruption due to strcat() function (#21)
Browse files Browse the repository at this point in the history
* Fixed memory corruption due to strcat() function

- The problem with memory stack corruption occurred in the 'fetch_saveimagepath()' function when starting the emulator.
Because the memory allocated on the stack `TCHAR path[MAX_DPATH]` in function `DISK_get_default_saveimagepath` does not have a end of line marker ('/0').
That's why further call of the strcat() function which first searches for a zero byte and then adds another string to it resulted in stack corruption in this place and application crash as a consequence.
- In other similar functions, the same scenario is possible.

* Update dummy.cpp

Compilation error, I forgot to specify the variable name

* Fixed memory corruption due to strcat() function

- The problem with memory stack corruption occurred in the 'fetch_saveimagepath()' function when starting the emulator.
Because the memory allocated on the stack `TCHAR path[MAX_DPATH]` in function `DISK_get_default_saveimagepath` does not have a end of line marker ('/0').
That's why further call of the strcat() function which first searches for a zero byte and then adds another string to it resulted in stack corruption in this place and application crash as a consequence.
- In other similar functions, the same scenario is possible.

* Fix crash if host processor doesn't support 'movbe' SSE3 extension

- My Intel processor 2011 does not support SSE3 extensions, in particular 'movbe' instruction. As a result, the emulator crashes with the error 'illegal instruction'
Therefore, I would recommend leaving the original #ifdef HAVE_MOVBE

* Refactor to pass .clangformat test
  • Loading branch information
DartFNM committed Mar 18, 2024
1 parent e01df20 commit 73b8932
Show file tree
Hide file tree
Showing 2 changed files with 38 additions and 5 deletions.
15 changes: 10 additions & 5 deletions src/dummy.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -777,23 +777,28 @@ void fastlane_add_scsi_unit(int, uaedev_config_info*, romconfig*) {
UNIMPLEMENTED();
}

void fetch_inputfilepath(char*, int) {
void fetch_inputfilepath(char* out, int) {
*out = 0;
UNIMPLEMENTED();
}

void fetch_ripperpath(char*, int) {
void fetch_ripperpath(char* out, int) {
*out = 0;
UNIMPLEMENTED();
}

void fetch_rompath(char*, int) {
void fetch_rompath(char* out, int) {
*out = 0;
UNIMPLEMENTED();
}

void fetch_saveimagepath(char*, int, int) {
void fetch_saveimagepath(char* out, int, int) {
*out = 0;
TRACE();
}

void fetch_videopath(char*, int) {
void fetch_videopath(char* out, int) {
*out = 0;
UNIMPLEMENTED();
}

Expand Down
28 changes: 28 additions & 0 deletions src/machdep/maccess.h
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,7 @@ STATIC_INLINE void do_put_mem_byte(uae_u8* a, uae_u8 v) {

#ifdef _WIN32

#ifdef HAVE_MOVBE
#include <immintrin.h>

STATIC_INLINE uae_u64 do_get_mem_quad(uae_u64* a) {
Expand All @@ -49,6 +50,33 @@ STATIC_INLINE void do_put_mem_long(uae_u32* a, uae_u32 v) {
STATIC_INLINE void do_put_mem_word(uae_u16* a, uae_u16 v) {
_store_be_u16(a, v);
}
#else /* HAVE_MOVBE */

STATIC_INLINE uae_u64 do_get_mem_quad(uae_u64* a) {
return _byteswap_uint64(*a);
}

STATIC_INLINE uae_u32 do_get_mem_long(uae_u32* a) {
return _byteswap_ulong(*a);
}

STATIC_INLINE uae_u16 do_get_mem_word(uae_u16* a) {
return _byteswap_ushort(*a);
}

STATIC_INLINE void do_put_mem_quad(uae_u64* a, uae_u64 v) {
*a = _byteswap_uint64(v);
}

STATIC_INLINE void do_put_mem_long(uae_u32* a, uae_u32 v) {
*a = _byteswap_ulong(v);
}

STATIC_INLINE void do_put_mem_word(uae_u16* a, uae_u16 v) {
*a = _byteswap_ushort(v);
}

#endif /* HAVE_MOVBE */

STATIC_INLINE uae_u64 do_byteswap_64(uae_u64 v) {
return _byteswap_uint64(v);
Expand Down

0 comments on commit 73b8932

Please sign in to comment.