RPCS3/rpcs3
1
0
Fork 0
mirror of https://github.com/RPCS3/rpcs3.git synced 2026-10-12 02:09:17 +00:00
Code Issues Packages Projects Releases Wiki Activity

Validate RPCN room message fields

Browse Source 
RPCN room peers control message payloads and destination lists. Values
above the Matching2 limits overflow the recipient's fixed event buffer
and terminate the NP handler.

Reject malformed room message notifications before allocating event
data.
This commit is contained in:
Acts1631
2026-10-07 16:17:15 +03:00
committed by Elad
parent 5f8dd1de61
commit cb63cc82ca
1 changed files with 24 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rpcs3/Emu/NP/np_notifications.cpp
+24
View File
@@ -229,6 +229,30 @@ namespace np
return;
}
const u32 cast_type = message_info->casttype().value();
const int dst_size = message_info->dst_size();
bool valid_destination = false;
switch (cast_type)
{
case SCE_NP_MATCHING2_CASTTYPE_BROADCAST:
valid_destination = dst_size == 0;
break;
case SCE_NP_MATCHING2_CASTTYPE_UNICAST:
case SCE_NP_MATCHING2_CASTTYPE_MULTICAST_TEAM:
valid_destination = dst_size == 1;
break;
case SCE_NP_MATCHING2_CASTTYPE_MULTICAST:
valid_destination = dst_size > 0 && dst_size <= SCE_NP_MATCHING2_ROOM_MAX_SLOT;
break;
}
if (!valid_destination || message_info->msg().size() > SCE_NP_MATCHING2_BIN_MSG_MAX_SIZE)
{
rpcn_log.error("Received malformed RoomMessageReceived notification");
return;
}
const u32 event_key = get_event_key();
auto [include_onlinename, include_avatarurl] = get_match2_context_options(room_event_cb_ctx);