RPCS3/rpcs3
1
0
Fork 0
mirror of https://github.com/RPCS3/rpcs3.git synced 2026-10-12 02:09:17 +00:00
Code Issues Packages Projects Releases Wiki Activity

Reject invalid RPCN message types

Browse Source 
RPCN forwards MessageDetails from other users. The protobuf uint16
wrappers can carry 32-bit values, and narrowing them on the recipient
aborts RPCS3.

Validate both values before casting so malformed messages are
discarded.
This commit is contained in:
Acts1631
2026-10-07 17:30:37 +03:00
committed by Elad
parent cb63cc82ca
commit e97200a884
1 changed files with 11 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rpcs3/Emu/NP/rpcn_client.cpp
+11 -2
View File
@@ -3249,10 +3249,19 @@ namespace rpcn
return;
}
const u32 main_type = pb_mdata->maintype().value();
const u32 sub_type = pb_mdata->subtype().value();
if (main_type > std::numeric_limits<u16>::max() || sub_type > std::numeric_limits<u16>::max())
{
rpcn_log.warning("Discarded message with invalid type! (main_type=%u, sub_type=%u)", main_type, sub_type);
return;
}
message_data mdata = {
.msgId = message_counter,
.mainType = ::narrow<u16>(pb_mdata->maintype().value()),
.subType = ::narrow<u16>(pb_mdata->subtype().value()),
.mainType = static_cast<u16>(main_type),
.subType = static_cast<u16>(sub_type),
.msgFeatures = pb_mdata->msgfeatures(),
.subject = pb_mdata->subject(),
.body = pb_mdata->body()};