Merge pull request #71 from NathanNeurotic/codex/fix-memcpy-usage-to-validate-buffer-sizes

Harden sceCdRM buffer handling and simplify PS1 helpers

Author: NathanNeurotic

include/libcdvd_add.h

@@ -13,7 +13,8 @@ int custom_sceCdReadRegionParams(u8 *data, u32 *stat);
  */
 int custom_sceCdReadPS1BootParam(char *param, u32 *stat);
 
-// Obtain model number from EEPROM via the mechacon SCMD 0x17
+// Obtain model number from EEPROM via the mechacon SCMD 0x17.
+// The caller must provide a buffer of at least 16 bytes (two 8-byte chunks).
 int sceCdRM(char *ModelName, u32 *stat);
 
 // Provides an equivalent of the sceCdBootCertify function from the newer CDVDMAN modules. The old CDVDFSV and CDVDMAN modules don't support this S-command.

src/libcdvd_add.c

@@ -6,6 +6,7 @@
 
 #include "debugprintf.h"
 #include "libcdvd_add.h"
+#include "util_safe.h"
 
 static unsigned char MECHACON_CMD_S36_supported = 0, MECHACON_CMD_S27_supported = 0, MECHACON_CMD_S24_supported = 0;
 
@@ -70,20 +71,32 @@ int sceCdRM(char *ModelName, u32 *stat)
     unsigned char rdata[9];
     unsigned char sdata;
     int result1, result2;
+    const size_t modelNameSize = 16; // Two 8-byte chunks
+
+    if (ModelName == NULL || stat == NULL) {
+        return 0;
+    }
+
+    memset(rdata, 0, sizeof(rdata));
+    memset(ModelName, 0, modelNameSize);
 
     sdata = 0;
     result1 = sceCdApplySCmd(0x17, &sdata, 1, rdata);
     // result1 = sceCdApplySCmd(0x17, &sdata, 1, rdata, 9);
 
     *stat = rdata[0];
-    memcpy(ModelName, &rdata[1], 8);
+    if (result1 != 0 && util_memcpy_s(ModelName, modelNameSize, &rdata[1], 8) != 0) {
+        result1 = 0;
+    }
 
     sdata = 8;
     result2 = sceCdApplySCmd(0x17, &sdata, 1, rdata);
     // result2 = sceCdApplySCmd(0x17, &sdata, 1, rdata, 9);
 
     *stat |= rdata[0];
-    memcpy(&ModelName[8], &rdata[1], 8);
+    if (result2 != 0 && util_memcpy_s(&ModelName[8], modelNameSize - 8, &rdata[1], 8) != 0) {
+        result2 = 0;
+    }
 
     return ((result1 != 0 && result2 != 0) ? 1 : 0);
 }

src/ps1.c

@@ -32,6 +32,31 @@ static char ps1drv_ver[64] = "";
 
 #define CNF_PATH_LEN_MAX 64
 
+static int HandleChineseBootParam(void)
+{
+    u32 stat;
+
+    if (OSDGetConsoleRegion() != CONSOLE_REGION_CHINA) {
+        return -1;
+    }
+
+    custom_sceCdReadPS1BootParam(ps1drv_boot, &stat);
+
+    if (stat & 0x180) { // Command unsupported or failed for some reason.
+        return 0;
+    }
+
+    if (ps1drv_boot[4] == '-')
+        ps1drv_boot[4] = '_';
+
+    ps1drv_boot[11] = '\0';
+    ps1drv_boot[10] = ps1drv_boot[9];
+    ps1drv_boot[9] = ps1drv_boot[8];
+    ps1drv_boot[8] = '.';
+
+    return 1;
+}
+
 int PS1DRVInit(void)
 {
     const char *pChar;
@@ -142,35 +167,15 @@ static void CNFGetKey(char *cnf, char *line, const char *key)
 
 static int ParseBootCNF(void)
 {
-    u32 stat;
     int fd;
+    int chinese_result;
 
     util_strlcpy(ps1drv_ver, "???", sizeof(ps1drv_ver));
     util_strlcpy(ps1drv_boot, "???", sizeof(ps1drv_boot));
 
-    if (OSDGetConsoleRegion() == CONSOLE_REGION_CHINA) { // China
-        /*  I do not know why Sony did this for the Chinese console (SCPH-50009).
-            Perhaps it as an act to strengthen their DRM for that release,
-            since PlayStation 2 game booting is also slightly different.
-
-            It is normally possible to actually parse SYSTEM.CNF and get the boot filename from BOOT.
-            Lots of homebrew software do that, and so does Sony (for all other regions).
-            But I do not know for sure whether that can be done for Chinese PlayStation discs. */
-        custom_sceCdReadPS1BootParam(ps1drv_boot, &stat);
-
-        if (stat & 0x180) { // Command unsupported or failed for some reason.
-            return 0;
-        }
-
-        if (ps1drv_boot[4] == '-')
-            ps1drv_boot[4] = '_';
-
-        ps1drv_boot[11] = '\0';
-        ps1drv_boot[10] = ps1drv_boot[9];
-        ps1drv_boot[9] = ps1drv_boot[8];
-        ps1drv_boot[8] = '.';
-
-        return 1;
+    chinese_result = HandleChineseBootParam();
+    if (chinese_result >= 0) {
+        return chinese_result;
     }
 
     if ((fd = open("cdrom0:\\SYSTEM.CNF;1", O_RDWR)) >= 0) {

src/util_safe.c

@@ -32,16 +32,24 @@ size_t util_strlcpy(char *dst, const char *src, size_t dst_size)
 {
     const size_t src_len = util_bounded_strnlen(src, SIZE_MAX);
 
-    if (dst_size > 0 && dst != NULL) {
-        const size_t copy_len = (src_len >= dst_size) ? dst_size - 1 : src_len;
-
-        if (src != NULL && copy_len > 0) {
-            if (util_memcpy_s(dst, dst_size, src, copy_len) != 0)
-                return src_len;
-        }
-        dst[copy_len] = '\0';
+    if (dst == NULL || dst_size == 0) {
+        return src_len;
     }
 
+    if (src == NULL) {
+        dst[0] = '\0';
+        return src_len;
+    }
+
+    const size_t copy_len = (src_len >= dst_size) ? dst_size - 1 : src_len;
+
+    if (copy_len > 0 && util_memcpy_s(dst, dst_size, src, copy_len) != 0) {
+        dst[0] = '\0';
+        return src_len;
+    }
+
+    dst[copy_len] = '\0';
+
     return src_len;
 }