portugalfuturista/rizin
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

CID 436255 Out-of-bounds read & code refactoring

Browse source
This commit is contained in:
wargio 2024-02-15 14:41:08 +08:00 committed by Anton Kochkov
parent 60e93b28ca
commit b4de5d53b2
2 changed files with 80 additions and 94 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

92
librz/bin/format/nin/nin.h
View file

@ -1,3 +1,5 @@
// SPDX-FileCopyrightText: 2024 deroad <wargio@libero.it>
// SPDX-FileCopyrightText: 2024 maijin <maijin21@gmail.com>
// SPDX-FileCopyrightText: 2013-2017 condret <condr3t@protonmail.com>
// SPDX-License-Identifier: LGPL-3.0-only
@ -66,93 +68,3 @@ const ut8 lic[] = {
0xbb, 0x67, 0x63, 0x6e, 0x0e, 0xec, 0xcc, 0xdd, 0xdc, 0x99, 0x9f,
0xbb, 0xb9, 0x33, 0x3e
};
const char *gb_card_type_str[] = {
"ROM",
"ROM+MBC1",
"ROM+MBC1+RAM",
"ROM+MBC1+RAM+BATT",
"ROM+MBC2",
"ROM+MBC2+BATT",
"ROM+RAM",
"ROM+RAM+BATT",
"ROM+MMM01",
"ROM+MMM01+SRAM",
"ROM+MMM01+SRAM+BATT",
"ROM+MBC3+TIMER+BATT",
"ROM+MBC3+TIMER+RAM+BATT",
"ROM+MBC3",
"ROM+MBC3+RAM",
"ROM+MBC3+RAM+BATT",
"ROM+MBC5",
"ROM+MBC5+RAM",
"ROM+MBC5+RAM+BATT",
"ROM+MBC5+RUMBLE",
"ROM+MBC5+RUMBLE+SRAM",
"ROM+MBC5+RUMBLE+SRAM+BATT",
"Pocket Camera",
"Bandai TAMA5",
"Hudson HuC-3",
"Hudson HuC-1"
};
void gb_add_cardtype(char *type, ut8 cardcode) {
strcat(type, "\ncard\t");
switch (cardcode) {
case GB_TAMA5:
case GB_HUC3:
case GB_HUC1:
strcat(type, gb_card_type_str[cardcode - 240]);
break;
case 0x15:
case 0x16:
case 0x17:
strcat(type, "XXX");
break;
default:
if (cardcode > GB_CAM) {
strcat(type, "XXX");
return;
}
strcat(type, gb_card_type_str[cardcode]);
break;
}
}
int gb_get_rombanks(ut8 id) {
switch (id) {
case GB_ROM_BANKS_2:
return 2;
case GB_ROM_BANKS_4:
return 4;
case GB_ROM_BANKS_8:
return 8;
case GB_ROM_BANKS_16:
return 16;
case GB_ROM_BANKS_32:
return 32;
case GB_ROM_BANKS_64:
return 64;
case GB_ROM_BANKS_128:
return 128;
case GB_ROM_BANKS_72:
return 72;
case GB_ROM_BANKS_80:
return 80;
case GB_ROM_BANKS_96:
return 96;
}
return 2;
}
void gb_get_gbtype(char *type, ut8 foo, ut8 bar) {
if (foo == GB_SGB) {
strcpy(type, "SuperGameboy-Rom");
} else {
if (bar == GB_GBC) {
strcpy(type, "GameboyColor-Rom");
} else {
strcpy(type, "Gameboy-Rom");
}
}
}

82
librz/bin/p/bin_ningb.c
View file

@ -1,3 +1,5 @@
// SPDX-FileCopyrightText: 2024 deroad <wargio@libero.it>
// SPDX-FileCopyrightText: 2024 maijin <maijin21@gmail.com>
// SPDX-FileCopyrightText: 2013-2017 condret <condr3t@protonmail.com>
// SPDX-License-Identifier: LGPL-3.0-only
@ -8,6 +10,73 @@
#include <string.h>
#include "../format/nin/nin.h"
static const char *gb_get_gameboy_type(ut8 byte0, ut8 byte1) {
if (byte0 == GB_SGB) {
return "SuperGameboy-Rom";
} else if (byte1 == GB_GBC) {
return "GameboyColor-Rom";
}
return "Gameboy-Rom";
}
static const char *gb_add_card_type(ut8 cardcode) {
switch (cardcode) {
case GB_ROM: return "ROM";
case GB_ROM_MBC1: return "ROM+MBC1";
case GB_ROM_MBC1_RAM: return "ROM+MBC1+RAM";
case GB_ROM_MBC1_RAM_BAT: return "ROM+MBC1+RAM+BATT";
case GB_ROM_MBC2: return "ROM+MBC2";
case GB_ROM_MBC2_BAT: return "ROM+MBC2+BATT";
case GB_ROM_RAM: return "ROM+RAM";
case GB_ROM_RAM_BAT: return "ROM+RAM+BATT";
case GB_ROM_MMM01: return "ROM+MMM01";
case GB_ROM_MMM01_SRAM: return "ROM+MMM01+SRAM";
case GB_ROM_MMM01_SRAM_BAT: return "ROM+MMM01+SRAM+BATT";
case GB_ROM_MBC3_TIMER_BAT: return "ROM+MBC3+TIMER+BATT";
case GB_ROM_MBC3_TIMER_RAM_BAT: return "ROM+MBC3+TIMER+RAM+BATT";
case GB_ROM_MBC3: return "ROM+MBC3";
case GB_ROM_MBC3_RAM: return "ROM+MBC3+RAM";
case GB_ROM_MBC3_RAM_BAT: return "ROM+MBC3+RAM+BATT";
case GB_ROM_MBC5: return "ROM+MBC5";
case GB_ROM_MBC5_RAM: return "ROM+MBC5+RAM";
case GB_ROM_MBC5_RAM_BAT: return "ROM+MBC5+RAM+BATT";
case GB_ROM_MBC5_RMBL: return "ROM+MBC5+RUMBLE";
case GB_ROM_MBC5_RMBL_SRAM: return "ROM+MBC5+RUMBLE+SRAM";
case GB_ROM_MBC5_RMBL_SRAM_BAT: return "ROM+MBC5+RUMBLE+SRAM+BATT";
case GB_CAM: return "Pocket Camera";
case GB_TAMA5: return "Bandai TAMA5";
case GB_HUC3: return "Hudson HuC-3";
case GB_HUC1: return "Hudson HuC-1";
default: return NULL;
}
}
static int gb_get_rombanks(ut8 id) {
switch (id) {
case GB_ROM_BANKS_2:
return 2;
case GB_ROM_BANKS_4:
return 4;
case GB_ROM_BANKS_8:
return 8;
case GB_ROM_BANKS_16:
return 16;
case GB_ROM_BANKS_32:
return 32;
case GB_ROM_BANKS_64:
return 64;
case GB_ROM_BANKS_128:
return 128;
case GB_ROM_BANKS_72:
return 72;
case GB_ROM_BANKS_80:
return 80;
case GB_ROM_BANKS_96:
return 96;
}
return 2;
}
static bool check_buffer(RzBuffer *b) {
ut8 lict[sizeof(lic)];
if (rz_buf_read_at(b, 0x104, lict, sizeof(lict)) == sizeof(lict)) {
@ -163,11 +232,16 @@ static RzBinInfo *info(RzBinFile *bf) {
return NULL;
}
rz_buf_read_at(bf->buf, 0x104, rom_header, 76);
const char *gbtype = gb_get_gameboy_type(rom_header[66], rom_header[63]);
const char *cardtype = gb_add_card_type(rom_header[67]);
if (cardtype) {
ret->type = rz_str_newf("%s %s", gbtype, cardtype);
} else {
ret->type = rz_str_newf("%s card_%02x", gbtype, (ut32)rom_header[67]);
}
ret->file = rz_str_ndup((const char *)&rom_header[48], 16);
ret->type = malloc(128);
ret->type[0] = 0;
gb_get_gbtype(ret->type, rom_header[66], rom_header[63]);
gb_add_cardtype(ret->type, rom_header[67]); // XXX
ret->machine = strdup("Gameboy");
ret->os = strdup("any");
ret->arch = strdup("gb");