The-Homebrew-Cloud/skyline
2
0
Fork 0
mirror of https://github.com/skyline-emu/skyline.git synced 2024-12-23 16:41:51 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix Logger Message OOB Access

Browse Source 
Certain titles can submit logs where the last field is one off by the buffer end, the logger loop now considers this and terminates if there isn't enough data left to read the field type and length.
This commit is contained in:
PixelyIon 2021-10-26 21:59:47 +05:30
parent 645183c903
commit 1f3519e6e3
1 changed files with 6 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
app/src/main/cpp/skyline/services/lm/ILogger.cpp
View File

@ -8,6 +8,7 @@ namespace skyline::service::lm {
ILogger::ILogger(const DeviceState &state, ServiceManager &manager) : BaseService(state, manager) {} ILogger::ILogger(const DeviceState &state, ServiceManager &manager) : BaseService(state, manager) {}
Result ILogger::Log(type::KSession &session, ipc::IpcRequest &request, ipc::IpcResponse &response) { Result ILogger::Log(type::KSession &session, ipc::IpcRequest &request, ipc::IpcResponse &response) {
auto inputBuffer{request.inputBuf.at(0)};
struct Data { struct Data {
u64 pid; u64 pid;
u64 threadContext; u64 threadContext;
@ -15,7 +16,7 @@ namespace skyline::service::lm {
LogLevel level; LogLevel level;
u8 verbosity; u8 verbosity;
u32 payloadLength; u32 payloadLength;
} &data = request.inputBuf.at(0).as<Data>(); } &data = inputBuffer.as<Data>();
struct LogMessage { struct LogMessage {
std::string_view message; std::string_view message;
@ -30,10 +31,10 @@ namespace skyline::service::lm {
} logMessage{}; } logMessage{};
u64 offset{sizeof(Data)}; u64 offset{sizeof(Data)};
while (offset < request.inputBuf[0].size()) { while ((offset + sizeof(LogFieldType) + sizeof(u8)) < inputBuffer.size()) { // The length of the last field sometimes doesn't add up to the buffer size, so we need to terminate the loop when we can't pop the type and length off the buffer
auto fieldType{request.inputBuf[0].subspan(offset++).as<LogFieldType>()}; auto fieldType{inputBuffer.subspan(offset++).as<LogFieldType>()};
auto length{request.inputBuf[0].subspan(offset++).as<u8>()}; auto length{inputBuffer.subspan(offset++).as<u8>()};
auto object{request.inputBuf[0].subspan(offset, length)}; auto object{inputBuffer.subspan(offset, length)};
switch (fieldType) { switch (fieldType) {
case LogFieldType::Start: case LogFieldType::Start: