admin/ci-libretro-fceumm
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
1185db89c15e738ca19874e675154c92be75f370
ci-libretro-fceumm/src/boards/unrom512.c
U-DESKTOP-SPFP6AQ\twistedtechre 1185db89c1 core: memory-safety, leak, and savestate-portability audit fixes 
Squashed series of ~50 distinct bugs found during a multi-day
security/correctness audit, ranging from ROM-triggerable heap
corruption and savestate-triggered OOB read primitives down to
obscure cross-platform savestate breakage.

Build is clean on `make platform=unix` with zero new warnings.

CRITICAL (ROM-triggerable, exploitable on the user's machine)
=============================================================

* ines.c iNES 2.0 PRG/CHR exponent overflow leading to undersized
  allocation followed by heap buffer overflow on fread (pow() with
  attacker-chosen exponent up to 63). Cap exponent at 30 and
  compute size in uint32 with explicit cap below 2 GiB before
  storing in int.
* ines.c miscROMSize int wraparound from attacker-controlled PRG/
  CHR sizes; previous '& 0x8000000' check missed common underflow
  cases. Compute in int64 and reject <= 0 or > 128 MiB.
* unif.c MAPR chunk OOB heap read on chunks of size < 4. Validate
  chunk size before allocating board-name buffer.
* unif.c chunk size truncation: int conversion + missing cap allowed
  a 4 GiB chunk size to wrap. Cap at 16 MiB.
* unif.c FixRomSize infinite loop on size > 0x80000000. Cap input.
* unif.c DINF chunk: months[(m - 1) % 12] is UB for m==0; m comes
  from the .unf file. Clamp m into [1..12] before subtracting.
* unif.c NAME chunk: GameInfo->name = malloc(...) was unchecked.
* nsf.c size underflow: FCEU_fgetsize() - 0x80 wraps to ~UINT64_MAX
  on tiny files, propagating a huge size into uppow2/FCEU_malloc.
  Validate size > 0x80 before subtracting.
* nsf.c NSFMaxBank * 4096 cap tightened from 1<<20 (UB on signed-int
  overflow) to 1<<19 (fits in int).
* general.c uppow2 had signed-int UB (1 << 32) and wrapped to 0 for
  inputs near uint32 max. Cap at 0x80000000.
* cheat.c SubCheats[256] BSS overflow when more than 256 GG/PAR
  substitution cheats are active. The array is adjacent to MMapPtrs[64]
  in BSS which is exposed via retro_get_memory_data, making this
  overflow visible from outside the core.
* libretro.c retro_cheat_set strcpy stack overflow with arbitrary-
  length cheat strings from the frontend. Use strlcpy.

CRITICAL (savestate-triggerable on a malicious .fcs file)
=========================================================

* fds.c FDS savestate OOB read primitive: InDisk loaded from
  savestate is used as index into 8-element diskdata[] static
  pointer array. A value 8..254 dereferences arbitrary memory as
  a pointer (heap-read primitive). Also bounds-checked SelectDisk,
  mapperFDS_block, mapperFDS_blockstart, mapperFDS_diskaddr,
  mapperFDS_blocklen so blockstart+diskaddr stays within the 65500-
  byte disk buffer.
* 11 mappers had savestate-loaded variables masked at write time
  but not at restore time, used as indices into fixed arrays:
    - 88.c, KS7037.c, 112.c   cmd indexes reg[8]
    - sachen.c (S8259, S74LS374N) cmd indexes latch[8]
    - 357.c    dipswitch indexes outer_bank[4]
    - unrom512.c flash_state indexes erase_a/d/b[5]
    - 368.c    preg indexes banks[8]
    - 69.c     sndcmd indexes sreg[14]
    - mmc2and4.c latch0/latch1 index creg[4]
  None individually exploitable into RCE - the array writes corrupt
  adjacent BSS with constrained data flowing in - but each is an
  out-of-bounds read or write from attacker-controllable input.

HIGH (memory-safety, reachable on any load)
===========================================

* fceu-memory.c FCEU_malloc deref-of-NULL on allocation failure
  ('ret = 0; memset(ret, 0, size);').
* file.c multiple FCEUFILE/MakeMemWrap/MakeMemWrapBuffer unchecked
  allocations and unchecked filestream_tell return.
* libretro.c GameInfo NULL-derefs in three entry points
  (retro_set_controller_port_device, retro_get_memory_data,
  retro_get_memory_size) reachable on operations called before a
  successful load.
* libretro.c framebuffer leak ~256 KB per failed FCEUI_LoadGame
  (the libretro frontend doesn't call retro_unload_game on a
  failed load).
* libretro.c 3DS retro_deinit unchecked linearFree.
* libretro.c stereo / NTSC filter unchecked malloc returns.
* fceu.c FCEUI_LoadGame unchecked GameInfo malloc.
* fds.c SubLoad and FDSLoad unchecked FCEU_malloc on diskdatao
  backup buffers (NULL-deref in subsequent memcpy).
* fceu.c AllocGenieRW partial-failure leak: AReadG allocated but
  BWriteG malloc fails -> 256 KB leak per retry.
* input/bworld.c Update(): unbounded strcpy from attacker-supplied
  data into 20-byte bdata. Replaced with length-bounded copy.
* cart.c setprg2r/4r and setchr1r/2r/4r/8r mask-underflow guards.
  SetupCartPRGMapping/SetupCartCHRMapping compute (size >> N) - 1
  which underflows to 0xFFFFFFFF for chips smaller than the unit.
  setprg8r/16r/32r and setchr8r already had defensive size checks;
  the smaller units did not. malee.c (2 KB chip) and mapper 218
  (2 KB NTARAM-as-CHR) accidentally avoid OOB; the primitive is
  unsafe for any future board.
* video.c FCEU_InitVirtualVideo XBuf/XDBuf partial-failure leak.
* video.c, fceu.c FCEU_DispMessage / FCEU_printf / FCEU_PrintError:
  vsprintf into fixed stack buffers replaced with vsnprintf.
* core: validate magic-string read length on FDS/UNIF/NSF load
  (reject files too short to contain the magic so previous static
  buffer / stack garbage doesn't spuriously match).

LEAKS (every cart load/unload cycle)
====================================

* mmc5.c MMC5 cart-side: WRAM (up to 64K) + MMC5fill (1K) + ExRAM
  (1K) leaked per cycle. NSFMMC5_Close existed but was only used
  for NSF code path.
* onebus.c Mapper 270/436: 8 KB CHRRAM leaked per cycle.
* 330.c, 375.c, 528.c: 8 KB WRAM each, no Close at all.

CORRECTNESS (UB / ABI / endianness)
===================================

* fceu-endian.c FlipByteOrder loop bound was 'count' instead of
  'count/2', making it a no-op for every even count and silently
  breaking savestate portability for every FCEUSTATE_RLSB-marked
  field. The '#ifndef GEKKO' workarounds scattered through the
  codebase (sound.c, vrc7.c, vrc6.c) were symptoms of this root
  cause.
* state.c AddExState bounds check ran AFTER writing the entry, so
  when SFEXINDEX hit the 63-entry cap the next call would write
  the entry then immediately overwrite it with the terminator.
* state.c FCEUSS_Save_Mem: post-save callback was guarded by
  'if (SPreSave)' instead of 'if (SPostSave)'.
* Sequence-point UB in counter expressions across 4 board files,
  e.g. 'x = !x ? a : --x' and 'x = ++x % n'. GCC -Wsequence-point
  flags all five sites (285.c, 413.c, asic_mmc3.c, jyasic.c).
* SFORMAT size mismatches between declared variable type and
  AddExState size argument:
    - asic_vrc3.c VRC3_count/VRC3_reload (uint16, saved as 1 byte)
    - mmc3.c m555_count (uint32, saved as 2 bytes), m555_count_-
      expired (uint8, saved as 2 bytes - OOB write into adjacent
      BSS).
* unrom512.c UNROM-512 mapper 30 .srm save format: host-endian
  uint32 flash write counters. Now stored as LE on disk regardless
  of host (Battle Kid 2, Twin Dragons, Lizard, Sole, etc.).
* ~70 multi-byte single-variable SFORMAT/AddExState entries across
  36 board files were saved as host-byte-order. After the
  FlipByteOrder fix, these are now byte-swapped on BE so cross-
  platform savestates round-trip correctly.
* coolgirl.c new ExStateLE() macro added; 22 multi-byte sites.
* pic16c5x.c 11 multi-byte AddExState calls (m_PC, m_PREVPC,
  m_CONFIG, m_WDT, m_prescaler, m_opcode, m_STACK[0/1], m_icount,
  m_delay_timer, m_rtcc, m_inst_cycles, m_clock2cycle).
* onebus.c PowerJoy Supermax submapper detection used non-portable
  *(uint32*)&info->MD5 cast that read different bytes on LE vs BE.
* fds.c clean up redundant FCEUSTATE_RLSB encoding in AddExState
  calls that also passed type=1 (idempotent OR; readability fix).

DOCUMENTATION
=============

* input.c UpdateGP's *(uint32*)data cast looks like a typical
  endian bug but is actually correct (the libretro frontend builds
  JSReturn with matching host-uint32 shifts). Comment added to
  prevent future "fixes" from breaking it.

Limitations not addressed
=========================

* Element-stride-aware byte swapping. The savestate byte-swap
  mechanism (FlipByteOrder over the entire SFORMAT entry buffer)
  is structurally wrong for arrays of multi-byte values: it
  reverses the whole buffer end-to-end instead of byte-swapping
  each element. Several places that need cross-platform-portable
  arrays (VRC7 sound state, jyasic chr[8]) work around this by
  either splitting arrays into per-element SFORMAT entries (n106
  PlayIndex, bandai reg) or by skipping save entirely on BE via
  #ifndef GEKKO. A proper fix would extend the size encoding with
  an element-stride field. Left for a future change because it
  would change the savestate format.

* Strict-aliasing UB in ppu.c (around 9 sites doing
  *(uint32*)uint8_buf for fast 4-byte writes via FCEU_dwmemset).
  Works in practice with all common compilers because the patterns
  are byte-symmetric, but is formally UB.

* FCEU_gmalloc calls exit(1) on OOM. A libretro core should never
  exit() because that takes down the whole frontend. Used by
  100+ call sites; refactoring to return-NULL is out of scope here.

Testing
=======

* Build: clean on `make platform=unix` with -O2; no new warnings.
* FlipByteOrder fix verified by hand-trace and a standalone unit
  test for counts 2, 4, 8.
* uppow2 fix verified by unit test across 13 boundary cases.
* SFORMAT size mismatches and missing-RLSB cases identified by
  Python static-analysis scripts that cross-reference SFORMAT
  entries against variable declarations.
* iNES 2.0 exponent fix verified by hand-tracing what byte 0xFF
  produces post-fix: exp=30 (capped), mult=7, size=3 GiB nominal,
  capped to 1 GiB, capped to 2 GiB by uppow2, FCEU_malloc returns
  NULL on most systems, loader returns 0. No heap overflow for
  any input byte.
* Savestate-loaded array index audit: built a Python scanner that
  extracts each AddExState/SFORMAT entry and cross-references the
  variable name against array-index uses in the same file. All
  flagged sites covered.
* A libFuzzer harness and seed corpus generator (fuzz_main.c,
  gen_seed_corpus.py) accompany this submission for ongoing
  regression testing.
2026-05-04 02:15:40 +02:00

303 lines
9.2 KiB
C
Raw Blame History

/* FCE Ultra - NES/Famicom Emulator
*
* Copyright notice for this file:
* Copyright (C) 2014 CaitSith2
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
*/
/*
* Roms still using NES 1.0 format should be loaded as 32K CHR RAM.
* Roms defined under NES 2.0 should use the VRAM size field, defining 7, 8 or 9, based on how much VRAM should be present.
* UNIF doesn't have this problem, because unique board names can define this information.
* The UNIF names are UNROM-512-8K, UNROM-512-16K and UNROM-512-32K
*
* The battery flag in the NES header enables flash, Mirrror mode 2 Enables MI_0 and MI_1 mode.
* Known games to use this board are:
* Battle Kid 2: Mountain of Torment (512K PRG, 8K CHR RAM, Horizontal Mirroring, Flash disabled)
* Study Hall (128K PRG (in 512K flash chip), 8K CHR RAM, Horizontal Mirroring, Flash enabled)
* Although Xmas 2013 uses a different board, where LEDs can be controlled (with writes to the $8000-BFFF space),
* it otherwise functions identically.
*
* 17-10-20 - Works with Mystic Origins (Demo)
*/
#include "mapinc.h"
/* Workaround for libretro api compatibility */
#define ROM_size_max 32
#define flashdata_size (ROM_size_max * 0x4000)
#define flash_write_count_size (ROM_size_max * 4 * sizeof(uint32))
static uint8 fceumm_flash_buf[flashdata_size + flash_write_count_size];
static uint32 fceumm_flash_buf_size = sizeof(fceumm_flash_buf);
static uint8 submapper;
static uint8 latche, latcheinit, bus_conflict, chrram_mask, software_id=0;
static uint16 latcha;
static uint8 *flashdata = fceumm_flash_buf + flash_write_count_size;
static uint32 *flash_write_count = (uint32*)fceumm_flash_buf;
static uint8 *FlashPage[32];
/* static uint32 *FlashWriteCountPage[32]; */
/* static uint8 flashloaded = 0; */
static uint8 flash_save = 0, flash_state = 0, flash_mode = 0, flash_bank;
static void (*WLSync)(void);
static void (*WHSync)(void);
static INLINE void setfpageptr(int s, uint32 A, uint8 *p) {
uint32 AB = A >> 11;
int x;
if (p)
for (x = (s >> 1) - 1; x >= 0; x--) {
FlashPage[AB + x] = p - A;
}
else
for (x = (s >> 1) - 1; x >= 0; x--) {
FlashPage[AB + x] = 0;
}
}
void setfprg16(uint32 A, uint32 V) {
if (PRGsize[0] >= 16384) {
V &= PRGmask16[0];
setfpageptr(16, A, flashdata ? (&flashdata[V << 14]) : 0);
} else {
int x;
uint32 VA = V << 3;
for (x = 0; x < 8; x++)
setfpageptr(2, A + (x << 11), flashdata ? (&flashdata[((VA + x) & PRGmask2[0]) << 11]) : 0);
}
}
/* The flash write count region (the first flash_write_count_size bytes of
* fceumm_flash_buf) is exposed verbatim to the frontend as battery save
* RAM. To keep .srm files portable between LE and BE builds, we always
* store the counters as little-endian on disk; on BE hosts that means
* byte-swapping at every counter access. */
static INLINE uint32 fwc_load(uint32 idx) {
#ifdef MSB_FIRST
uint8 *p = (uint8 *)&flash_write_count[idx];
return (uint32)p[0] | ((uint32)p[1] << 8) | ((uint32)p[2] << 16) | ((uint32)p[3] << 24);
#else
return flash_write_count[idx];
#endif
}
static INLINE void fwc_store(uint32 idx, uint32 v) {
#ifdef MSB_FIRST
uint8 *p = (uint8 *)&flash_write_count[idx];
p[0] = (uint8)v;
p[1] = (uint8)(v >> 8);
p[2] = (uint8)(v >> 16);
p[3] = (uint8)(v >> 24);
#else
flash_write_count[idx] = v;
#endif
}
void inc_flash_write_count(uint8 bank, uint32 A) {
uint32 idx = (bank * 4) + ((A & 0x3000) >> 12);
uint32 v = fwc_load(idx) + 1;
if (v == 0) v = 1; /* avoid wrap to 0 (which means "never written") */
fwc_store(idx, v);
}
uint32 GetFlashWriteCount(uint8 bank, uint32 A) {
return fwc_load((bank * 4) + ((A & 0x3000) >> 12));
}
static void StateRestore(int version) {
/* erase_a/d/b[] are 5-element arrays indexed by flash_state.
* Legitimate values are 0..4; clamp savestate values that exceed
* the array to a safe value to avoid OOB reads. */
if (flash_state >= 5)
flash_state = 0;
if (flash_mode > 2)
flash_mode = 0;
WHSync();
}
static DECLFW(UNROM512LLatchWrite) {
latche = V;
latcha = A;
WLSync();
}
static DECLFW(UNROM512HLatchWrite) {
if (bus_conflict)
latche = (V == CartBR(A)) ? V : 0;
else
latche = V;
latcha = A;
WHSync();
}
static DECLFR(UNROM512LatchRead) {
uint8 flash_id[3] = { 0xB5, 0xB6, 0xB7 };
if (software_id) {
if (A & 1)
return flash_id[ROM_size >> 4];
else
return 0xBF;
}
if (flash_save) {
if (A < 0xC000) {
if (GetFlashWriteCount(flash_bank, A))
return FlashPage[A >> 11][A];
} else {
if (GetFlashWriteCount(ROM_size - 1, A))
return FlashPage[A >> 11][A];
}
}
return Page[A >> 11][A];
}
static void UNROM512LatchPower(void) {
latche = latcheinit;
WHSync();
SetReadHandler(0x8000, 0xFFFF, UNROM512LatchRead);
if (submapper == 0 && !flash_save || submapper == 2)
SetWriteHandler(0x8000, 0xFFFF, UNROM512HLatchWrite);
else
{
if (submapper != 4) SetWriteHandler(0x8000, 0xBFFF, UNROM512LLatchWrite);
SetWriteHandler(0xC000, 0xFFFF, UNROM512HLatchWrite);
}
}
static void UNROM512LatchClose(void) {
}
static void UNROM512LSync(void) {
int erase_a[5] = { 0x9555, 0xAAAA, 0x9555, 0x9555, 0xAAAA };
int erase_d[5] = { 0xAA, 0x55, 0x80, 0xAA, 0x55 };
int erase_b[5] = { 1, 0, 1, 1, 0 };
if (flash_mode==0) {
if ((latcha == erase_a[flash_state]) && (latche == erase_d[flash_state]) && (flash_bank == erase_b[flash_state])) {
flash_state++;
if (flash_state == 5) {
flash_mode = 1;
}
}
else if ((flash_state == 2) && (latcha == 0x9555) && (latche == 0xA0) && (flash_bank == 1)) {
flash_state++;
flash_mode = 2;
}
else if ((flash_state == 2) && (latcha == 0x9555) && (latche == 0x90) && (flash_bank == 1)) {
flash_state = 0;
software_id = 1;
} else {
if (latche == 0xF0)
software_id = 0;
flash_state = 0;
}
}
else if (flash_mode == 1) { /* Chip Erase or Sector Erase */
if (latche == 0x30) {
inc_flash_write_count(flash_bank,latcha);
memset(&FlashPage[(latcha & 0xF000) >> 11][latcha & 0xF000], 0xFF, 0x1000);
}
else if (latche == 0x10) {
uint32 i;
for(i = 0; i < (ROM_size * 4); i++)
inc_flash_write_count(i >> 2,i << 12);
memset(flashdata, 0xFF, ROM_size * 0x4000); /* Erasing the rom chip as instructed. Crash rate calulated to be 99.9% :) */
}
flash_state = 0;
flash_mode = 0;
}
else if (flash_mode == 2) { /* Byte Program */
if (!GetFlashWriteCount(flash_bank, latcha)) {
inc_flash_write_count(flash_bank, latcha);
memcpy(&FlashPage[(latcha & 0xF000) >> 11][latcha & 0xF000], &Page[(latcha & 0xF000) >> 11][latcha & 0xF000], 0x1000);
}
FlashPage[latcha >> 11][latcha] &= latche;
flash_state = 0;
flash_mode = 0;
}
}
static void UNROM512HSync(void) {
flash_bank=latche&(ROM_size - 1);
setprg16(0x8000, flash_bank);
setprg16(0xc000, ~0);
setfprg16(0x8000, flash_bank);
setfprg16(0xC000, ~0);
setchr8r(0, (latche & chrram_mask) >> 5);
if (submapper == 3)
setmirror(latche &0x80? MI_V: MI_H);
else
setmirror(MI_0 + (latche >> 7));
}
void UNROM512_Init(CartInfo *info) {
int mirror;
submapper = info->submapper;
memset(fceumm_flash_buf, 0x00, fceumm_flash_buf_size);
flash_state = 0;
flash_bank = 0;
flash_save = info->battery;
if (info->CHRRamSize == 8192)
chrram_mask = 0;
else if (info->CHRRamSize == 16384)
chrram_mask = 0x20;
else
chrram_mask = 0x60;
mirror = (head.ROM_type & 1) | ((head.ROM_type & 8) >> 2);
if (submapper == 3) /* Mega Man II (30th Anniversary Edition): switchable H/V */
SetupCartMirroring(MI_V, 0, NULL);
else
switch (mirror) {
case 0: /* hard horizontal, internal */
SetupCartMirroring(MI_H, 1, NULL);
break;
case 1: /* hard vertical, internal */
SetupCartMirroring(MI_V, 1, NULL);
break;
case 2: /* switchable 1-screen, internal (flags: 4-screen + horizontal) */
SetupCartMirroring(MI_0, 0, NULL);
break;
case 3: /* hard four screen, last 8k of 32k RAM (flags: 4-screen + vertical) */
SetupCartMirroring(4, 1, VROM + (info->CHRRamSize - 8192));
break;
}
bus_conflict = submapper == 0 && !info->battery || submapper == 2;
latcheinit = 0;
WLSync = UNROM512LSync;
WHSync = UNROM512HSync;
info->Power = UNROM512LatchPower;
info->Close = UNROM512LatchClose;
GameStateRestore = StateRestore;
if (flash_save)
{
info->SaveGame[0] = fceumm_flash_buf;
info->SaveGameLen[0] = fceumm_flash_buf_size;
AddExState(flash_write_count,ROM_size * 4 * sizeof(uint32), 0, "FLASH_WRITE_COUNT");
AddExState(flashdata,ROM_size * 0x4000, 0, "FLASH_DATA");
AddExState(&flash_state, 1, 0, "FLASH_STATE");
AddExState(&flash_mode, 1, 0, "FLASH_MODE");
AddExState(&flash_bank, 1, 0, "FLASH_BANK");
AddExState(&latcha, 2, 1, "LATA");
}
AddExState(&latche, 1, 0, "LATC");
AddExState(&bus_conflict, 1, 0, "BUSC");
}
Reference in New Issue View Git Blame Copy Permalink