xenia
xenia copied to clipboard
BitStream - Lack of handling when offset > (buffer_size - 8) causes access violation
Validation
- [X] I've read the FAQ.
- [X] The Xenia build used is from the master branch (not MLBS/AlexVS/Canary/pull requests, etc.)
- [X] This issue isn't for tech support (help with Xenia).
- [X] If this issue occurs in a specific game, I've done analysis to locate the faulty subsystem of the emulator and a potential reason in it.
- [X] I've checked if this issue hasn't already been reported.
- [X] My device meets the minimum requirements: https://github.com/xenia-project/xenia/wiki/Quickstart#system-requirements
- [X] (If building) I have read the building doc: https://github.com/xenia-project/xenia/blob/master/docs/building.md
Describe what's going wrong
https://github.com/xenia-project/xenia/blob/master/src/xenia/base/bit_stream.cc#L39
Because we're not checking how many bytes are there to the end of our buffer we can expect access violation when next page is unallocated and our offset is less than 8 bytes to end of buffer.
Describe what should happen
There are 2 solutions easy one and more complex one.
- (easy/cheap) Add check that would prevent reading buffer when offset is near end of current buffer and force offset to be at least 8 bytes before end of buffer.
Commit: https://github.com/xenia-canary/xenia-canary/commit/7975ea78d4b33f3c60e9562ab62c42488c269491
- (Not sure if possible) Rewrite bitstream to read max 2 bytes at the time. Bitstream is used only for audio and in this case max size of audio frame is 0x7FFF anyway.
If applicable, provide a callstack here, especially for crashes
No response
If applicable, upload a logfile and link it here
No response