portugalfuturista/rizin
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Replace unsafe string functions in gb plugins
Some checks failed
Code scanning / build (CodeQL-cpp) (push) Has been cancelled
Details
Code scanning / build (CodeQL-javascript) (push) Has been cancelled
Details
Code scanning / build (CodeQL-python) (push) Has been cancelled
Details
Mixed linter and checks / changes (push) Has been cancelled
Details
Mixed linter and checks / licenses (push) Has been cancelled
Details
Muon build / ubuntu-muon (push) Has been cancelled
Details
TinyCC build / ubuntu-tcc-test (push) Has been cancelled
Details
Mixed linter and checks / cmd_descs_yaml_check (push) Has been cancelled
Details
Mixed linter and checks / bindgen-linter (push) Has been cancelled
Details
Mixed linter and checks / clang-format (push) Has been cancelled
Details
Mixed linter and checks / prettier (push) Has been cancelled
Details
Mixed linter and checks / python (push) Has been cancelled
Details

Browse source 
None of these should be exploitable, but we want to get rid of these
unsafe functions.
This commit is contained in:
Florian Märkl 2026-07-11 13:29:29 +02:00
parent a3c35a88a1
commit 5353b06952
3 changed files with 115 additions and 62 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

164
librz/arch/isa/gb/gbdis.c
View file

@ -25,127 +25,179 @@ static int gbOpLength(int gboptype) {
}
}
static void gb_hardware_register_name(char *reg, ut8 offset) {
static void gb_hardware_register_name(char *reg, size_t reg_sz, ut8 offset) {
switch (offset) {
case 0x00: // Joy pad info
rz_str_cpy(reg, "rP1") break;
rz_str_ncpy(reg, "rP1", reg_sz);
break;
case 0x01: // Serial Transfer Data
rz_str_cpy(reg, "rSB") break;
rz_str_ncpy(reg, "rSB", reg_sz);
break;
case 0x02: // Serial I/O Control
rz_str_cpy(reg, "rSC") break;
rz_str_ncpy(reg, "rSC", reg_sz);
break;
case 0x04: // Divider register
rz_str_cpy(reg, "rDIV") break;
rz_str_ncpy(reg, "rDIV", reg_sz);
break;
case 0x05: // Timer Counter
rz_str_cpy(reg, "rTIMA") break;
rz_str_ncpy(reg, "rTIMA", reg_sz);
break;
case 0x06: // Timer modulo
rz_str_cpy(reg, "rTMA") break;
rz_str_ncpy(reg, "rTMA", reg_sz);
break;
case 0x07: // Timer control
rz_str_cpy(reg, "rTAC") break;
rz_str_ncpy(reg, "rTAC", reg_sz);
break;
case 0x0f: // Interrupt Flag
rz_str_cpy(reg, "rIF") break;
rz_str_ncpy(reg, "rIF", reg_sz);
break;
// Audio Channel #1
case 0x10: // Sweep Register
rz_str_cpy(reg, "rAUD1SWEEP") break;
rz_str_ncpy(reg, "rAUD1SWEEP", reg_sz);
break;
case 0x11: // Sound length/Wave pattern duty
rz_str_cpy(reg, "rAUD1LEN") break;
rz_str_ncpy(reg, "rAUD1LEN", reg_sz);
break;
case 0x12: // Envelope
rz_str_cpy(reg, "rAUD1ENV") break;
rz_str_ncpy(reg, "rAUD1ENV", reg_sz);
break;
case 0x13: // Frequency low
rz_str_cpy(reg, "rAUD1LOW") break;
rz_str_ncpy(reg, "rAUD1LOW", reg_sz);
break;
case 0x14: // Frequency high
rz_str_cpy(reg, "rAUD1HIGH") break;
rz_str_ncpy(reg, "rAUD1HIGH", reg_sz);
break;
// Audio Channel #2
case 0x16: // Sound length/Wave pattern duty
rz_str_cpy(reg, "rAUD2LEN") break;
rz_str_ncpy(reg, "rAUD2LEN", reg_sz);
break;
case 0x17: // Envelope
rz_str_cpy(reg, "rAUD2ENV") break;
rz_str_ncpy(reg, "rAUD2ENV", reg_sz);
break;
case 0x18: // Frequency low
rz_str_cpy(reg, "rAUD2LOW") break;
rz_str_ncpy(reg, "rAUD2LOW", reg_sz);
break;
case 0x19: // Frequency high
rz_str_cpy(reg, "rAUD2HIGH") break;
rz_str_ncpy(reg, "rAUD2HIGH", reg_sz);
break;
// Sound Channel #3
case 0x1a: // Sound on/off
rz_str_cpy(reg, "rAUD3ENA") break;
rz_str_ncpy(reg, "rAUD3ENA", reg_sz);
break;
case 0x1b: // Sound length
rz_str_cpy(reg, "rAUD3LEN") break;
rz_str_ncpy(reg, "rAUD3LEN", reg_sz);
break;
case 0x1c: // Select output level
rz_str_cpy(reg, "rAUD3LEVEL") break;
rz_str_ncpy(reg, "rAUD3LEVEL", reg_sz);
break;
case 0x1d: // Frequency low
rz_str_cpy(reg, "rAUD3LOW") break;
rz_str_ncpy(reg, "rAUD3LOW", reg_sz);
break;
case 0x1e: // Frequency high
rz_str_cpy(reg, "rAUD3HIGH") break;
rz_str_ncpy(reg, "rAUD3HIGH", reg_sz);
break;
// Sound Channel #4
case 0x20: // Sound length
rz_str_cpy(reg, "rAUD4LEN") break;
rz_str_ncpy(reg, "rAUD4LEN", reg_sz);
break;
case 0x21: // Envelope
rz_str_cpy(reg, "rAUD4ENV") break;
rz_str_ncpy(reg, "rAUD4ENV", reg_sz);
break;
case 0x22: // Polynomial counter
rz_str_cpy(reg, "rAUD4POLY") break;
rz_str_ncpy(reg, "rAUD4POLY", reg_sz);
break;
// Sound (general)
case 0x23:
rz_str_cpy(reg, "rAUD4GO") break;
rz_str_ncpy(reg, "rAUD4GO", reg_sz);
break;
case 0x24: // Channel control / ON-OFF / Volume
rz_str_cpy(reg, "rAUDVOL") break;
rz_str_ncpy(reg, "rAUDVOL", reg_sz);
break;
case 0x25: // Selection of Sound output terminal
rz_str_cpy(reg, "rAUDTERM") break;
rz_str_ncpy(reg, "rAUDTERM", reg_sz);
break;
case 0x26: // Sound on/off
rz_str_cpy(reg, "rAUDENA") break;
rz_str_ncpy(reg, "rAUDENA", reg_sz);
break;
case 0x76: // Sound Channel 1&2 PCM amplitude
rz_str_cpy(reg, "rPCM12") break;
rz_str_ncpy(reg, "rPCM12", reg_sz);
break;
case 0x77: // Sound Channel 3&4 PCM amplitude
rz_str_cpy(reg, "rPCM34") break;
rz_str_ncpy(reg, "rPCM34", reg_sz);
break;
case 0x40: // LCD Control
rz_str_cpy(reg, "rLCDC") break;
rz_str_ncpy(reg, "rLCDC", reg_sz);
break;
case 0x41: // LCD Status
rz_str_cpy(reg, "rSTAT") break;
rz_str_ncpy(reg, "rSTAT", reg_sz);
break;
case 0x42: // Scroll Y
rz_str_cpy(reg, "rSCY") break;
rz_str_ncpy(reg, "rSCY", reg_sz);
break;
case 0x43: // Scroll X
rz_str_cpy(reg, "rSCX") break;
rz_str_ncpy(reg, "rSCX", reg_sz);
break;
case 0x44: // Y-Coordinate
rz_str_cpy(reg, "rLY") break;
rz_str_ncpy(reg, "rLY", reg_sz);
break;
case 0x45: // Y-Coordinate Compare
rz_str_cpy(reg, "rLYC") break;
rz_str_ncpy(reg, "rLYC", reg_sz);
break;
case 0x46: // Transfer and Start Address
rz_str_cpy(reg, "rDMA") break;
rz_str_ncpy(reg, "rDMA", reg_sz);
break;
case 0x47: // BG Palette Data
rz_str_cpy(reg, "rBGP") break;
rz_str_ncpy(reg, "rBGP", reg_sz);
break;
case 0x48: // Object Palette 0 Data
rz_str_cpy(reg, "rOBP0") break;
rz_str_ncpy(reg, "rOBP0", reg_sz);
break;
case 0x49: // Object Palette 1 Data
rz_str_cpy(reg, "rOBP1") break;
rz_str_ncpy(reg, "rOBP1", reg_sz);
break;
case 0x4a: // Window Y Position
rz_str_cpy(reg, "rWY") break;
rz_str_ncpy(reg, "rWY", reg_sz);
break;
case 0x4b: // Window X Position
rz_str_cpy(reg, "rWX") break;
rz_str_ncpy(reg, "rWX", reg_sz);
break;
case 0x4d: // Select CPU Speed
rz_str_cpy(reg, "rKEY1") break;
rz_str_ncpy(reg, "rKEY1", reg_sz);
break;
case 0x4f: // Select Video RAM Bank
rz_str_cpy(reg, "rVBK") break;
rz_str_ncpy(reg, "rVBK", reg_sz);
break;
case 0x51: // Horizontal Blanking, General Purpose DMA
case 0x52: // Horizontal Blanking, General Purpose DMA
case 0x53: // Horizontal Blanking, General Purpose DMA
case 0x54: // Horizontal Blanking, General Purpose DMA
case 0x55: // Horizontal Blanking, General Purpose DMA
sprintf(reg, "rHDMA%d", offset - 0x50);
snprintf(reg, reg_sz, "rHDMA%d", offset - 0x50);
break;
case 0x56: // Infrared Communications Port
rz_str_cpy(reg, "rRP") break;
rz_str_ncpy(reg, "rRP", reg_sz);
break;
case 0x68: // Background Color Palette Specification
rz_str_cpy(reg, "rBCPS") break;
rz_str_ncpy(reg, "rBCPS", reg_sz);
break;
case 0x69: // Background Color Palette Data
rz_str_cpy(reg, "rBCPD") break;
rz_str_ncpy(reg, "rBCPD", reg_sz);
break;
case 0x6a: // Object Color Palette Specification
rz_str_cpy(reg, "rOCPS") break;
rz_str_ncpy(reg, "rOCPS", reg_sz);
break;
case 0x6b: // Object Color Palette Data
rz_str_cpy(reg, "rOCPD") break;
rz_str_ncpy(reg, "rOCPD", reg_sz);
break;
case 0x70: // Select Main RAM Bank
rz_str_cpy(reg, "rSVBK") break;
rz_str_ncpy(reg, "rSVBK", reg_sz);
break;
case 0xff: // Interrupt Enable Flag
rz_str_cpy(reg, "rIE") break;
rz_str_ncpy(reg, "rIE", reg_sz);
break;
default:
// If unknown, return the original address
sprintf(reg, "0xff%02x", offset);
snprintf(reg, reg_sz, "0xff%02x", (unsigned int)offset);
break;
}
}
@ -171,7 +223,7 @@ RZ_IPI int gbDisass(RzAsmOp *op, const ut8 *buf, int len) {
rz_asm_op_setf_asm(op, gb_op[buf[0]].name, buf[1] + 0x100 * buf[2]);
break;
case GB_8BIT + ARG_8 + GB_IO:
gb_hardware_register_name(reg, buf[1]);
gb_hardware_register_name(reg, sizeof(reg), buf[1]);
rz_asm_op_setf_asm(op, gb_op[buf[0]].name, reg);
break;
default:

12
librz/arch/p/analysis/analysis_gb.c
View file

@ -1178,20 +1178,20 @@ static int gb_anop(RzAnalysis *analysis, RzAnalysisOp *op, ut64 addr, const ut8
memset(reg, '\0', sizeof(reg));
switch (gb_op[data[0]].type) {
case GB_8BIT:
sprintf(mn, "%s", gb_op[data[0]].name);
snprintf(mn, sizeof(mn), "%s", gb_op[data[0]].name);
break;
case GB_16BIT:
sprintf(mn, "%s %s", cb_ops[data[1] >> 3], cb_regs[data[1] & 7]);
snprintf(mn, sizeof(mn), "%s %s", cb_ops[data[1] >> 3], cb_regs[data[1] & 7]);
break;
case GB_8BIT + ARG_8:
sprintf(mn, gb_op[data[0]].name, data[1]);
snprintf(mn, sizeof(mn), gb_op[data[0]].name, data[1]);
break;
case GB_8BIT + ARG_16:
sprintf(mn, gb_op[data[0]].name, data[1] | (data[2] << 8));
snprintf(mn, sizeof(mn), gb_op[data[0]].name, data[1] | (data[2] << 8));
break;
case GB_8BIT + ARG_8 + GB_IO:
gb_hardware_register_name(reg, data[1]);
sprintf(mn, gb_op[data[0]].name, reg);
gb_hardware_register_name(reg, sizeof(reg), data[1]);
snprintf(mn, sizeof(mn), gb_op[data[0]].name, reg);
break;
}
op->mnemonic = rz_str_dup(mn);

1
test/db/asm/gb
View file

@ -223,6 +223,7 @@ d "ld [rOCPS], a" e06a 0x0 (store 0 (bv 16 0xff6a) (var a))
d "ld [rOCPD], a" e06b 0x0 (store 0 (bv 16 0xff6b) (var a))
d "ld [rSVBK], a" e070 0x0 (store 0 (bv 16 0xff70) (var a))
d "ld [rIE], a" e0ff 0x0 (store 0 (bv 16 0xffff) (var a))
d "ld [0xff80], a" e080 0x0 (store 0 (bv 16 0xff80) (var a))
d "ld [bc], a" 02 0x0 (store 0 (append (var b) (var c)) (var a))
d "ld [de], a" 12 0x0 (store 0 (append (var d) (var e)) (var a))
d "ld [hl], 0x42" 3642 0x0 (store 0 (append (var h) (var l)) (bv 8 0x42))