cdrom: handle fifo overreads

[pcsx_rearmed.git] / libpcsxcore / ppf.c

diff --git a/libpcsxcore/ppf.c b/libpcsxcore/ppf.c
index 268ed1c..18c5413 100644 (file)
--- a/libpcsxcore/ppf.c
+++ b/libpcsxcore/ppf.c
@@ -183,13 +183,15 @@ void BuildPPFCache() {
        char                    method, undo = 0, blockcheck = 0;
        int                             dizlen, dizyn;
        unsigned char   ppfmem[512];
-       char                    szPPF[MAXPATHLEN];
+       char                    szPPF[MAXPATHLEN * 2];
        int                             count, seekpos, pos;
        u32                             anz; // use 32-bit to avoid stupid overflows
        s32                             ladr, off, anx;
 
        FreePPFCache();
 
+       if (CdromId[0] == '\0') return;
+
        // Generate filename in the format of SLUS_123.45
        buffer[0] = toupper(CdromId[0]);
        buffer[1] = toupper(CdromId[1]);
@@ -210,7 +212,8 @@ void BuildPPFCache() {
        if (ppffile == NULL) return;
 
        memset(buffer, 0, 5);
-       fread(buffer, 3, 1, ppffile);
+       if (fread(buffer, 1, 3, ppffile) != 3)
+               goto fail_io;
 
        if (strcmp(buffer, "PPF") != 0) {
                SysPrintf(_("Invalid PPF patch: %s.\n"), szPPF);
@@ -233,12 +236,14 @@ void BuildPPFCache() {
                        fseek(ppffile, -8, SEEK_END);
 
                        memset(buffer, 0, 5);
-                       fread(buffer, 4, 1, ppffile);
+                       if (fread(buffer, 1, 4, ppffile) != 4)
+                               goto fail_io;
 
                        if (strcmp(".DIZ", buffer) != 0) {
                                dizyn = 0;
                        } else {
-                               fread(&dizlen, 4, 1, ppffile);
+                               if (fread(&dizlen, 1, 4, ppffile) != 4)
+                                       goto fail_io;
                                dizlen = SWAP32(dizlen);
                                dizyn = 1;
                        }
@@ -264,12 +269,15 @@ void BuildPPFCache() {
 
                        fseek(ppffile, -6, SEEK_END);
                        memset(buffer, 0, 5);
-                       fread(buffer, 4, 1, ppffile);
+                       if (fread(buffer, 1, 4, ppffile) != 4)
+                               goto fail_io;
                        dizlen = 0;
 
                        if (strcmp(".DIZ", buffer) == 0) {
                                fseek(ppffile, -2, SEEK_END);
-                               fread(&dizlen, 2, 1, ppffile);
+                               // TODO: Endian/size unsafe?
+                               if (fread(&dizlen, 1, 2, ppffile) != 2)
+                                       goto fail_io;
                                dizlen = SWAP32(dizlen);
                                dizlen += 36;
                        }
@@ -296,13 +304,19 @@ void BuildPPFCache() {
        // now do the data reading
        do {                                                
                fseek(ppffile, seekpos, SEEK_SET);
-               fread(&pos, 4, 1, ppffile);
+               if (fread(&pos, 1, sizeof(pos), ppffile) != sizeof(pos))
+                       goto fail_io;
                pos = SWAP32(pos);
 
-               if (method == 2) fread(buffer, 4, 1, ppffile); // skip 4 bytes on ppf3 (no int64 support here)
+               if (method == 2) {
+                       // skip 4 bytes on ppf3 (no int64 support here)
+                       if (fread(buffer, 1, 4, ppffile) != 4)
+                               goto fail_io;
+               }
 
                anz = fgetc(ppffile);
-               fread(ppfmem, anz, 1, ppffile);   
+               if (fread(ppfmem, 1, anz, ppffile) != anz)
+                       goto fail_io;
 
                ladr = pos / CD_FRAMESIZE_RAW;
                off = pos % CD_FRAMESIZE_RAW;
@@ -329,31 +343,54 @@ void BuildPPFCache() {
        FillPPFCache(); // build address array
 
        SysPrintf(_("Loaded PPF %d.0 patch: %s.\n"), method + 1, szPPF);
+
+fail_io:
+#ifndef NDEBUG
+       SysPrintf(_("File IO error in <%s:%s>.\n"), __FILE__, __func__);
+#endif
+       fclose(ppffile);
 }
 
 // redump.org SBI files, slightly different handling from PCSX-Reloaded
 unsigned char *sbi_sectors;
 
 int LoadSBI(const char *fname, int sector_count) {
-       char buffer[16], sbifile[MAXPATHLEN];
+       char buffer[16];
        FILE *sbihandle;
-       u8 sbitime[3];
+       u8 sbitime[3], t;
        int s;
 
        sbihandle = fopen(fname, "rb");
        if (sbihandle == NULL)
                return -1;
 
-if (sbi_sectors != NULL) printf("sbi_sectors?\n");
        sbi_sectors = calloc(1, sector_count / 8);
-       if (sbi_sectors == NULL)
+       if (sbi_sectors == NULL) {
+               fclose(sbihandle);
                return -1;
+       }
 
        // 4-byte SBI header
-       fread(buffer, 1, 4, sbihandle);
-       while (!feof(sbihandle)) {
-               fread(sbitime, 1, 3, sbihandle);
-               fread(buffer, 1, 11, sbihandle);
+       if (fread(buffer, 1, 4, sbihandle) != 4)
+               goto fail_io;
+
+       while (1) {
+               s = fread(sbitime, 1, 3, sbihandle);
+               if (s != 3)
+                       goto fail_io;
+               if (fread(&t, 1, sizeof(t), sbihandle) != sizeof(t))
+                       goto fail_io;
+               switch (t) {
+               default:
+               case 1:
+                       s = 10;
+                       break;
+               case 2:
+               case 3:
+                       s = 3;
+                       break;
+               }
+               fseek(sbihandle, s, SEEK_CUR);
 
                s = MSF2SECT(btoi(sbitime[0]), btoi(sbitime[1]), btoi(sbitime[2]));
                if (s < sector_count)
@@ -363,8 +400,14 @@ if (sbi_sectors != NULL) printf("sbi_sectors?\n");
        }
 
        fclose(sbihandle);
-
        return 0;
+
+fail_io:
+#ifndef NDEBUG
+       SysPrintf(_("File IO error in <%s:%s>.\n"), __FILE__, __func__);
+#endif
+       fclose(sbihandle);
+       return -1;
 }
 
 void UnloadSBI(void) {