Browse code

Protect system_cmd from reading out of bounds

Devine Lu Linvega authored on 02/02/2023 18:20:19
Showing 2 changed files
... ...
@@ -32,27 +32,26 @@ system_print(Stack *s, char *name)
32 32
 	fprintf(stderr, "\n");
33 33
 }
34 34
 
35
-void
36
-system_inspect(Uxn *u)
35
+static void
36
+system_cmd(Uint8 *ram, Uint16 addr)
37 37
 {
38
-	system_print(u->wst, "wst");
39
-	system_print(u->rst, "rst");
38
+	if(ram[addr] == 0x01) {
39
+		int src, dst;
40
+		Uint16 i, args[5]; /* length, a_page, a_addr, b_page, b_addr */
41
+		for(i = 0; i < 5; i++)
42
+			args[i] = PEEK16(ram + addr + 1 + i * 2);
43
+		src = (args[1] % RAM_PAGES) * 0x10000;
44
+		dst = (args[3] % RAM_PAGES) * 0x10000;
45
+		for(i = 0; i < args[0]; i++)
46
+			ram[dst + (Uint16)(args[4] + i)] = ram[src + (Uint16)(args[2] + i)];
47
+	}
40 48
 }
41 49
 
42
-/* RAM */
43
-
44 50
 void
45
-system_cmd(Uint8 *ram, Uint16 addr)
51
+system_inspect(Uxn *u)
46 52
 {
47
-	Uint16 a = addr, i = 0;
48
-	Uint8 o = ram[a++];
49
-	if(o == 1) {
50
-		Uint16 length = (ram[a++] << 8) + ram[a++];
51
-		Uint16 src_page = ((ram[a++] << 8) + ram[a++]) % 16, src_addr = (ram[a++] << 8) + ram[a++];
52
-		Uint16 dst_page = ((ram[a++] << 8) + ram[a++]) % 16, dst_addr = (ram[a++] << 8) + ram[a];
53
-		for(i = 0; i < length; i++)
54
-			ram[dst_page * 0x10000 + dst_addr + i] = ram[src_page * 0x10000 + src_addr + i];
55
-	}
53
+	system_print(u->wst, "wst");
54
+	system_print(u->rst, "rst");
56 55
 }
57 56
 
58 57
 int
... ...
@@ -10,6 +10,7 @@ WITH REGARD TO THIS SOFTWARE.
10 10
 */
11 11
 
12 12
 #define RAM_PAGES 0x10
13
+#define PEEK16(d) ((d)[0] << 8 | (d)[1])
13 14
 
14 15
 int system_load(Uxn *u, char *filename);
15 16
 void system_deo(Uxn *u, Uint8 *d, Uint8 port);