Skip to content

Commit

Permalink
Core: Fix IPL device m_cursor overflow
Browse files Browse the repository at this point in the history
Not sure if the behavior I'm implementing here is what real hardware
does, but since this is a buffer overflow, I'd like to get it fixed
quickly. Hardware verification can happen later.

https://bugs.dolphin-emu.org/issues/13506
  • Loading branch information
JosJuice committed Mar 25, 2024
1 parent d57c68a commit 8fafcc3
Showing 1 changed file with 4 additions and 0 deletions.
4 changes: 4 additions & 0 deletions Source/Core/Core/HW/EXI/EXI_DeviceIPL.cpp
Expand Up @@ -320,6 +320,8 @@ void CEXIIPL::TransferByte(u8& data)
if (!m_command.is_write())
{
u32 dev_addr = address - ROM_BASE + m_cursor++;
// TODO: Is this address wrapping correct?
dev_addr %= ROM_SIZE;
// Technically we should descramble here iff descrambling logic is enabled.
// At the moment, we pre-decrypt the whole thing and
// ignore the "enabled" bit - see CEXIIPL::CEXIIPL
Expand All @@ -346,6 +348,8 @@ void CEXIIPL::TransferByte(u8& data)
{
auto& sram = m_system.GetSRAM();
u32 dev_addr = address - SRAM_BASE + m_cursor++;
// TODO: Is this address wrapping correct?
dev_addr %= SRAM_SIZE;
if (m_command.is_write())
sram[dev_addr] = data;
else
Expand Down

0 comments on commit 8fafcc3

Please sign in to comment.