Reject malformed savestate container metadata - #2712
Open
acts-1631 wants to merge 1 commit into
Open
Conversation
Savestate section lengths previously allowed zero-length records, causing the section scanner to loop forever on a crafted state file. FIFO metadata restored from a state file was also used without checking that its count and indices fit the target container, allowing a subsequent emulated FIFO write to access host memory out of bounds. Reject truncated and invalid section records, and fail state loading when restored FIFO metadata is outside the container bounds.
gajae1
added a commit
to gajae1/melonDS
that referenced
this pull request
Sep 7, 2026
… validation Limit wrapped capture readback to the remaining blocks. Validate section headers and lengths before both returning a matching section and skipping one. Reuse the one-line ARMJIT fix authored by Ogato in melonDS-emu#2654; its base ARMJIT.cpp blob matches this fork. The savestate work is informed by melonDS-emu#2712 but also validates matching sections before returning. FIFO validation from that PR is not included. Add focused standalone C++ regression tests and a GCC/Clang sanitizer workflow. Document measurement-first performance direction without introducing a language rewrite or unmeasured SIMD requirements. Locally verified: 7/7 CTest entries with GCC 14.2 and Clang 17 ASan/UBSan. These are dependency-isolated tests, not a complete emulator build, real OpenGL execution, or game/performance validation.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Savestate::FindSection previously trusted each on-disk section length when
advancing through the file. A zero-length record prevented the cursor from
advancing, causing state loading to loop indefinitely.
FIFO, DynamicFIFO, and RingBuffer also restored their count and cursor fields
without validating them against the container capacity. A malformed save state
could therefore leave a queue with invalid indices that were later used for
array access.
Reject truncated and invalid section records, and fail savestate loading when
restored FIFO metadata is outside the associated container bounds.