Yaya48/dolphin
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

AMMediaboard: Add NetworkCMDBufferCheck calls for reading of timeout in Select commands.

Browse Source
This commit is contained in:
Jordan Woyak committed 2026-02-15 20:14:14 -06:00
1 parent 95442a2b6a
commit a5eca09967
1 file changed
+20 -13
Download Patch File Download Diff File Expand all files Collapse all files
Source/Core/Core/HW/DVD/AMMediaboard.cpp
+20 -13
View File
@@ -996,7 +996,7 @@ u32 ExecuteCommand(std::array<u32, 3>& dicmd_buf, u32* diimm_buf, u32 address, u
fd_set* exceptfds = nullptr; fd_set* exceptfds = nullptr;
timeval timeout = {}; timeval timeout = {};
u8* timeout_src = nullptr; std::optional<u32> timeout_offset;
fd_set fds; fd_set fds;
FD_ZERO(&fds); FD_ZERO(&fds);
@@ -1018,24 +1018,27 @@ u32 ExecuteCommand(std::array<u32, 3>& dicmd_buf, u32* diimm_buf, u32 address, u
if (s_media_buffer_32[3] != 0) if (s_media_buffer_32[3] != 0)
{ {
readfds = &fds; readfds = &fds;
timeout_src = s_network_command_buffer + s_media_buffer_32[3] - NetworkCommandAddress2; timeout_offset = s_media_buffer_32[3] - NetworkCommandAddress2;
} }
else if (s_media_buffer_32[4] != 0) else if (s_media_buffer_32[4] != 0)
{ {
writefds = &fds; writefds = &fds;
timeout_src = s_network_command_buffer + s_media_buffer_32[4] - NetworkCommandAddress2; timeout_offset = s_media_buffer_32[4] - NetworkCommandAddress2;
} }
else if (s_media_buffer_32[5] != 0) else if (s_media_buffer_32[5] != 0)
{ {
exceptfds = &fds; exceptfds = &fds;
timeout_src = s_network_command_buffer + s_media_buffer_32[5] - NetworkCommandAddress2; timeout_offset = s_media_buffer_32[5] - NetworkCommandAddress2;
} }
} }
// Copy timeout if set // Copy timeout if set
if (timeout_src != nullptr) if (timeout_offset.has_value())
{ {
std::memcpy(&timeout, timeout_src, sizeof(timeval)); if (!NetworkCMDBufferCheck(*timeout_offset, sizeof(timeval)))
break;
std::memcpy(&timeout, s_network_command_buffer + *timeout_offset, sizeof(timeval));
} }
// BUG: The game sets timeout to two seconds // BUG: The game sets timeout to two seconds
@@ -1237,6 +1240,7 @@ u32 ExecuteCommand(std::array<u32, 3>& dicmd_buf, u32* diimm_buf, u32 address, u
if ((offset >= 0x00400000) && (offset <= 0x600000)) if ((offset >= 0x00400000) && (offset <= 0x600000))
{ {
const u32 fw_offset = offset - 0x00400000; const u32 fw_offset = offset - 0x00400000;
// TODO: Bounds checking for s_firmware
memory.CopyFromEmu(s_firmware + fw_offset, address, length); memory.CopyFromEmu(s_firmware + fw_offset, address, length);
return 0; return 0;
} }
@@ -1578,7 +1582,7 @@ u32 ExecuteCommand(std::array<u32, 3>& dicmd_buf, u32* diimm_buf, u32 address, u
fd_set* exceptfds = nullptr; fd_set* exceptfds = nullptr;
timeval timeout = {}; timeval timeout = {};
u8* timeout_src = nullptr; std::optional<u32> timeout_offset;
fd_set fds; fd_set fds;
FD_ZERO(&fds); FD_ZERO(&fds);
@@ -1600,24 +1604,27 @@ u32 ExecuteCommand(std::array<u32, 3>& dicmd_buf, u32* diimm_buf, u32 address, u
if (s_media_buffer_32[11] != 0) if (s_media_buffer_32[11] != 0)
{ {
readfds = &fds; readfds = &fds;
timeout_src = s_network_command_buffer + s_media_buffer_32[11] - NetworkCommandAddress1; timeout_offset = s_media_buffer_32[11] - NetworkCommandAddress1;
} }
else if (s_media_buffer_32[12] != 0) else if (s_media_buffer_32[12] != 0)
{ {
writefds = &fds; writefds = &fds;
timeout_src = s_network_command_buffer + s_media_buffer_32[12] - NetworkCommandAddress1; timeout_offset = s_media_buffer_32[12] - NetworkCommandAddress1;
} }
else if (s_media_buffer_32[13] != 0) else if (s_media_buffer_32[13] != 0)
{ {
exceptfds = &fds; exceptfds = &fds;
timeout_src = s_network_command_buffer + s_media_buffer_32[13] - NetworkCommandAddress1; timeout_offset = s_media_buffer_32[13] - NetworkCommandAddress1;
} }
} }
// Copy timeout if set // Copy timeout if set
if (timeout_src != nullptr) if (timeout_offset.has_value())
{ {
std::memcpy(&timeout, timeout_src, sizeof(timeval)); if (!NetworkCMDBufferCheck(*timeout_offset, sizeof(timeval)))
break;
std::memcpy(&timeout, s_network_command_buffer + *timeout_offset, sizeof(timeval));
} }
// BUG?: F-Zero AX Monster calls select with a two second timeout // BUG?: F-Zero AX Monster calls select with a two second timeout
@@ -1629,7 +1636,7 @@ u32 ExecuteCommand(std::array<u32, 3>& dicmd_buf, u32* diimm_buf, u32 address, u
} }
const int ret = const int ret =
select(fd + 1, readfds, writefds, exceptfds, timeout_src ? &timeout : nullptr); select(fd + 1, readfds, writefds, exceptfds, timeout_offset ? &timeout : nullptr);
const int err = WSAGetLastError(); const int err = WSAGetLastError();
NOTICE_LOG_FMT(AMMEDIABOARD_NET, NOTICE_LOG_FMT(AMMEDIABOARD_NET,