Pārlūkot izejas kodu

Be careful of mangled out of bounds read

Kelebek1 3 gadi atpakaļ
vecāks
revīzija
42b16bb33a
2 mainītis faili ar 9 papildinājumiem un 9 dzēšanām
  1. 9 5
      src/common/demangle.cpp
  2. 0 4
      src/core/arm/arm_interface.cpp

+ 9 - 5
src/common/demangle.cpp

@@ -2,6 +2,7 @@
 // SPDX-License-Identifier: GPL-2.0-or-later
 
 #include "common/demangle.h"
+#include "common/scope_exit.h"
 
 namespace llvm {
 char* itaniumDemangle(const char* mangled_name, char* buf, size_t* n, int* status);
@@ -13,10 +14,16 @@ std::string DemangleSymbol(const std::string& mangled) {
     auto is_itanium = [](const std::string& name) -> bool {
         // A valid Itanium encoding requires 1-4 leading underscores, followed by 'Z'.
         auto pos = name.find_first_not_of('_');
-        return pos > 0 && pos <= 4 && name[pos] == 'Z';
+        return pos > 0 && pos <= 4 && pos < name.size() && name[pos] == 'Z';
     };
 
+    if (mangled.empty()) {
+        return mangled;
+    }
+
     char* demangled = nullptr;
+    SCOPE_EXIT({ std::free(demangled); });
+
     if (is_itanium(mangled)) {
         demangled = llvm::itaniumDemangle(mangled.c_str(), nullptr, nullptr, nullptr);
     }
@@ -24,10 +31,7 @@ std::string DemangleSymbol(const std::string& mangled) {
     if (!demangled) {
         return mangled;
     }
-
-    std::string ret = demangled;
-    std::free(demangled);
-    return ret;
+    return demangled;
 }
 
 } // namespace Common

+ 0 - 4
src/core/arm/arm_interface.cpp

@@ -1,10 +1,6 @@
 // SPDX-FileCopyrightText: Copyright 2018 yuzu Emulator Project
 // SPDX-License-Identifier: GPL-2.0-or-later
 
-#ifndef _MSC_VER
-#include <cxxabi.h>
-#endif
-
 #include <map>
 #include <optional>