Merge branch 'RPCS3:master' into startup-fix

Author: BeezBumba

3rdparty/libsdl-org/SDL

@@ -627,7 +627,20 @@ bool SCEDecrypter::LoadMetadata(const u8 erk[32], const u8 riv[16])
 {
 	aes_context aes;
 	std::vector<u8> metadata_info(sizeof(meta_info));
-	std::vector<u8> metadata_headers(sce_hdr.se_hsize - (sizeof(sce_hdr) + sce_hdr.se_meta + sizeof(meta_info)));
+	constexpr usz sizeof_meta_and_header = sizeof(meta_info) + sizeof(sce_hdr);
+	const usz metadata_offset = static_cast<usz>(sce_hdr.se_meta);
+
+	if (metadata_offset > usz{umax} - sizeof_meta_and_header ||
+		sce_hdr.se_hsize < sizeof_meta_and_header + metadata_offset ||
+		sce_hdr.se_hsize - (sizeof_meta_and_header + metadata_offset) < sizeof(meta_hdr) ||
+		sce_hdr.se_hsize > sce_f.size())
+	{
+		self_log.error("Invalid SCE metadata header size!");
+		return false;
+	}
+
+	const usz metadata_headers_offset = sizeof_meta_and_header + metadata_offset;
+	std::vector<u8> metadata_headers(sce_hdr.se_hsize - metadata_headers_offset);
 
 	// Locate and read the encrypted metadata info.
 	sce_f.seek(sce_hdr.se_meta + sizeof(sce_hdr));
@@ -1123,7 +1136,20 @@ bool SELFDecrypter::LoadMetadata(const u8* klic_key)
 {
 	aes_context aes;
 	std::vector<u8> metadata_info(sizeof(meta_info));
-	std::vector<u8> metadata_headers(sce_hdr.se_hsize - (sizeof(sce_hdr) + sce_hdr.se_meta + sizeof(meta_info)));
+	constexpr usz sizeof_meta_and_header = sizeof(meta_info) + sizeof(sce_hdr);
+	const usz metadata_offset = static_cast<usz>(sce_hdr.se_meta);
+
+	if (metadata_offset > usz{umax} - sizeof_meta_and_header ||
+		sce_hdr.se_hsize < sizeof_meta_and_header + metadata_offset ||
+		sce_hdr.se_hsize - (sizeof_meta_and_header + metadata_offset) < sizeof(meta_hdr) ||
+		sce_hdr.se_hsize > self_f.size())
+	{
+		self_log.error("Invalid SELF metadata header size!");
+		return false;
+	}
+
+	const usz metadata_headers_offset = sizeof_meta_and_header + metadata_offset;
+	std::vector<u8> metadata_headers(sce_hdr.se_hsize - metadata_headers_offset);
 
 	// Locate and read the encrypted metadata info.
 	self_f.seek(sce_hdr.se_meta + sizeof(sce_hdr));

rpcs3/Crypto/unself.cpp

@@ -324,7 +324,7 @@ std::function<void(void*)> lv2_prx::load(utils::serial& ar)
 	const u32 state{ar};
 
 	usz seg_count = 0;
-	ar.deserialize_vle(seg_count);
+	ar.deserialize_vle<9>(seg_count);
 
 	shared_ptr<lv2_prx> prx;
 

rpcs3/Emu/Cell/lv2/sys_prx.cpp

@@ -84,6 +84,7 @@ namespace rsx
 				break;
 			}
 
+			const bool main_menu_is_current_page = m_main_menu.is_current_page;
 			const page_navigation navigation = m_main_menu.handle_button_press(button_press, is_auto_repeat, m_auto_repeat_ms_interval);
 
 			switch (navigation)
@@ -110,6 +111,12 @@ namespace rsx
 			}
 			case page_navigation::exit:
 			{
+				// Don't exit if circle was pressed in the main menu
+				if (main_menu_is_current_page && button_press == pad_button::circle)
+				{
+					break;
+				}
+
 				// Don't call close() synchronously from the input thread - just like the pause menu's own
 				// "Exit Game", tearing down the shell on the main thread takes this dialog down as a side effect.
 				g_big_picture_mode_active = false;

rpcs3/Emu/RSX/Overlays/BigPicture/overlay_big_picture.cpp

@@ -161,7 +161,7 @@ namespace rsx
 
 		void big_picture_game_grid::finish_reload(std::vector<std::unique_ptr<big_picture_game_tile>>&& tiles)
 		{
-			std::lock_guard lock(m_reload_mutex);
+			std::lock_guard lock(m_mutex);
 
 			if (thread_ctrl::state() == thread_state::aborting)
 			{
@@ -280,6 +280,8 @@ namespace rsx
 
 		page_navigation big_picture_game_grid::handle_button_press(pad_button button_press, bool is_auto_repeat, u64 auto_repeat_interval_ms)
 		{
+			std::lock_guard lock(m_mutex);
+
 			if (m_loading) return page_navigation::stay;
 
 			const bool do_play_sound = !is_auto_repeat || auto_repeat_interval_ms >= user_interface::m_auto_repeat_ms_interval_default;
@@ -322,12 +324,8 @@ namespace rsx
 				if (button_press == pad_button::circle)
 				{
 					play_sound(sound_effect::cancel);
-					if (parent)
-					{
-						set_current_page(parent);
-						return page_navigation::back;
-					}
-					return page_navigation::exit;
+					set_current_page(ensure(parent));
+					return page_navigation::back;
 				}
 
 				return page_navigation::stay;
@@ -372,12 +370,8 @@ namespace rsx
 				return page_navigation::stay;
 			case pad_button::circle:
 				play_sound(sound_effect::cancel);
-				if (parent)
-				{
-					set_current_page(parent);
-					return page_navigation::back;
-				}
-				return page_navigation::exit;
+				set_current_page(ensure(parent));
+				return page_navigation::back;
 			default:
 				return page_navigation::stay;
 			}
@@ -392,7 +386,7 @@ namespace rsx
 
 		compiled_resource& big_picture_game_grid::get_compiled()
 		{
-			std::lock_guard lock(m_reload_mutex);
+			std::lock_guard lock(m_mutex);
 
 			if (!m_highlight->is_compiled() ||
 				(!m_tiles.empty() && m_grid && !m_grid->is_compiled()) ||

rpcs3/Emu/RSX/Overlays/BigPicture/overlay_big_picture_game_grid.cpp

@@ -52,7 +52,7 @@ namespace rsx
 			static constexpr u16 m_columns = 5;
 			static constexpr u16 m_tile_size = 200;
 
-			std::mutex m_reload_mutex;
+			std::mutex m_mutex;
 			std::unique_ptr<named_thread<std::function<void()>>> m_game_enumeration_thread;
 
 			game_enumeration<big_picture_game_info> m_game_enumeration;

rpcs3/Emu/RSX/Overlays/BigPicture/overlay_big_picture_game_grid.h

@@ -1,6 +1,5 @@
 #include "stdafx.h"
 #include "overlay_manager.h"
-#include "Emu/System.h"
 #include <util/asm.hpp>
 
 namespace rsx

rpcs3/Emu/RSX/Overlays/overlay_manager.cpp

@@ -943,6 +943,8 @@ bool Emulator::BootRsxCapture(const std::string& path)
 	GetCallbacks().on_ready();
 
 	GetCallbacks().init_gs_render(nullptr);
+	GetCallbacks().init_kb_handler();
+	GetCallbacks().init_mouse_handler();
 	GetCallbacks().init_pad_handler("");
 
 	GetCallbacks().on_run(false);
@@ -1001,6 +1003,8 @@ bool Emulator::BootBigPictureMode()
 	GetCallbacks().on_ready();
 
 	GetCallbacks().init_gs_render(nullptr);
+	GetCallbacks().init_kb_handler();
+	GetCallbacks().init_mouse_handler();
 	GetCallbacks().init_pad_handler("");
 
 	GetCallbacks().on_run(false);

rpcs3/Emu/System.cpp

@@ -373,7 +373,9 @@ class elf_object
 					// Try to find it in phdr data instead of allocating new section
 					p_index++;
 
-					if (hdr.p_offset <= shdr.sh_offset && shdr.sh_offset + shdr.sh_size <= hdr.p_offset + hdr.p_filesz)
+					if (hdr.p_offset <= shdr.sh_offset &&
+						shdr.sh_size <= hdr.p_filesz &&
+						shdr.sh_offset - hdr.p_offset <= hdr.p_filesz - shdr.sh_size)
 					{
 						const auto& prog = ::at32(progs, p_index);
 						shdrs.back().bin_view = {prog.bin.data() + shdr.sh_offset - hdr.p_offset, shdr.sh_size};
@@ -469,7 +471,9 @@ class elf_object
 					p_index++;
 
 					// Rely on previous sh_offset value!
-					if (hdr.p_offset <= shdr.sh_offset && shdr.sh_offset + shdr.sh_size - 1 <= hdr.p_offset + hdr.p_filesz - 1)
+					if (hdr.p_offset <= shdr.sh_offset &&
+						shdr.sh_size <= hdr.p_filesz &&
+						shdr.sh_offset - hdr.p_offset <= hdr.p_filesz - shdr.sh_size)
 					{
 						out.sh_offset = ::narrow<sz_t>(data_base + static_cast<usz>(shdr.sh_offset - hdr.p_offset));
 						result = true;

rpcs3/Loader/ELF.h

@@ -206,9 +206,12 @@ namespace utils
 			return true;
 		}
 
-		template <typename T> requires Integral<T>
+		template <uint MaxBits = 0, typename T> requires Integral<T> && (MaxBits <= sizeof(T) * 8)
 		bool deserialize_vle(T& value)
 		{
+			using unsigned_type = std::make_unsigned_t<T>;
+			unsigned_type result{};
+			constexpr u32 bit_width = MaxBits ? sizeof(T) * 8 : MaxBits;
 			value = {};
 
 			for (u32 i = 0;; i += 7)
@@ -220,12 +223,25 @@ namespace utils
 					return false;
 				}
 
-				value |= static_cast<T>(byte_data % 0x80) << i;
+				const unsigned_type payload = static_cast<unsigned_type>(byte_data % 0x80);
+
+				if (i >= bit_width || payload > (~unsigned_type{} >> i))
+				{
+					return false;
+				}
+
+				result |= payload << i;
 
 				if (!(byte_data & 0x80))
 				{
+					value = static_cast<T>(result);
 					break;
 				}
+
+				if (i > bit_width - 7)
+				{
+					return false;
+				}
 			}
 
 			return true;
@@ -290,14 +306,21 @@ namespace utils
 			}
 
 			usz size = 0;
-			if (!deserialize_vle(size))
+			if (!deserialize_vle<28>(size))
 			{
 				return false;
 			}
 
 			if constexpr (Bitcopy<typename T::value_type>)
 			{
-				if (!raw_serialize([&](){ obj.resize(size); return obj.data(); }, sizeof(obj[0]) * size))
+				if (size > static_cast<usz>(umax) / sizeof(obj[0]))
+				{
+					return false;
+				}
+
+				const usz data_size = sizeof(obj[0]) * size;
+
+				if (!raw_serialize([&](){ obj.resize(size); return obj.data(); }, data_size))
 				{
 					obj.clear();
 					return false;
@@ -400,7 +423,7 @@ namespace utils
 			}
 
 			usz size = 0;
-			if (!deserialize_vle(size))
+			if (!deserialize_vle<28>(size))
 			{
 				return false;
 			}