Merge pull request #543 from gameblabla/hle_fies_corruption_libretro

Properly protect the HLE instructions against corrupted memory.

diff --git a/libpcsxcore/new_dynarec/new_dynarec.c b/libpcsxcore/new_dynarec/new_dynarec.c
index bb6ff0b..79df8da 100644 (file)
--- a/libpcsxcore/new_dynarec/new_dynarec.c
+++ b/libpcsxcore/new_dynarec/new_dynarec.c
@@ -3489,7 +3489,11 @@ void hlecall_assemble(int i,struct regstat *i_regs)
   assert(!is_delayslot);
   (void)ccreg;
   emit_movimm(start+i*4+4,0); // Get PC
-  emit_movimm((int)psxHLEt[source[i]&7],1);
+  uint32_t hleCode = source[i] & 0x03ffffff;
+  if (hleCode >= (sizeof(psxHLEt) / sizeof(psxHLEt[0])))
+    emit_movimm((int)psxNULL,1);
+  else
+    emit_movimm((int)psxHLEt[hleCode],1);
   emit_addimm(HOST_CCREG,CLOCK_ADJUST(ccadj[i]),HOST_CCREG); // XXX
   emit_jmp((int)jump_hlecall);
 }

diff --git a/libpcsxcore/psxhle.c b/libpcsxcore/psxhle.c
index 7507192..d575cb7 100644 (file)
--- a/libpcsxcore/psxhle.c
+++ b/libpcsxcore/psxhle.c
@@ -95,7 +95,7 @@ static void hleExecRet() {
        psxRegs.pc = psxRegs.GPR.n.ra;
 }
 
-void (*psxHLEt[256])() = {
+const void (*psxHLEt[8])() = {
        hleDummy, hleA0, hleB0, hleC0,
        hleBootstrap, hleExecRet,
        hleDummy, hleDummy

diff --git a/libpcsxcore/psxhle.h b/libpcsxcore/psxhle.h
index eef78e8..0529c38 100644 (file)
--- a/libpcsxcore/psxhle.h
+++ b/libpcsxcore/psxhle.h
@@ -28,7 +28,7 @@ extern "C" {
 #include "r3000a.h"
 #include "plugins.h"
 
-extern void (*psxHLEt[256])();
+extern const void (*psxHLEt[8])();
 
 #ifdef __cplusplus
 }

diff --git a/libpcsxcore/psxinterpreter.c b/libpcsxcore/psxinterpreter.c
index e904cee..6c19f06 100644 (file)
--- a/libpcsxcore/psxinterpreter.c
+++ b/libpcsxcore/psxinterpreter.c
@@ -856,7 +856,13 @@ void psxBASIC(struct psxCP2Regs *regs) {
 
 void psxHLE() {
 //     psxHLEt[psxRegs.code & 0xffff]();
-       psxHLEt[psxRegs.code & 0x07]();         // HDHOSHY experimental patch
+//     psxHLEt[psxRegs.code & 0x07]();         // HDHOSHY experimental patch
+    uint32_t hleCode = psxRegs.code & 0x03ffffff;
+    if (hleCode >= (sizeof(psxHLEt) / sizeof(psxHLEt[0]))) {
+        psxNULL();
+    } else {
+        psxHLEt[hleCode]();
+    }
 }
 
 void (*psxBSC[64])() = {