From b4de5d53b243bd403ae230d76411691a3f2cc5c2 Mon Sep 17 00:00:00 2001 From: wargio Date: Thu, 15 Feb 2024 14:41:08 +0800 Subject: [PATCH] CID 436255 Out-of-bounds read & code refactoring --- librz/bin/format/nin/nin.h | 92 +------------------------------------- librz/bin/p/bin_ningb.c | 82 +++++++++++++++++++++++++++++++-- 2 files changed, 80 insertions(+), 94 deletions(-) diff --git a/librz/bin/format/nin/nin.h b/librz/bin/format/nin/nin.h index 897bbacb1d..90fe18a5d1 100644 --- a/librz/bin/format/nin/nin.h +++ b/librz/bin/format/nin/nin.h @@ -1,3 +1,5 @@ +// SPDX-FileCopyrightText: 2024 deroad +// SPDX-FileCopyrightText: 2024 maijin // SPDX-FileCopyrightText: 2013-2017 condret // SPDX-License-Identifier: LGPL-3.0-only @@ -66,93 +68,3 @@ const ut8 lic[] = { 0xbb, 0x67, 0x63, 0x6e, 0x0e, 0xec, 0xcc, 0xdd, 0xdc, 0x99, 0x9f, 0xbb, 0xb9, 0x33, 0x3e }; - -const char *gb_card_type_str[] = { - "ROM", - "ROM+MBC1", - "ROM+MBC1+RAM", - "ROM+MBC1+RAM+BATT", - "ROM+MBC2", - "ROM+MBC2+BATT", - "ROM+RAM", - "ROM+RAM+BATT", - "ROM+MMM01", - "ROM+MMM01+SRAM", - "ROM+MMM01+SRAM+BATT", - "ROM+MBC3+TIMER+BATT", - "ROM+MBC3+TIMER+RAM+BATT", - "ROM+MBC3", - "ROM+MBC3+RAM", - "ROM+MBC3+RAM+BATT", - "ROM+MBC5", - "ROM+MBC5+RAM", - "ROM+MBC5+RAM+BATT", - "ROM+MBC5+RUMBLE", - "ROM+MBC5+RUMBLE+SRAM", - "ROM+MBC5+RUMBLE+SRAM+BATT", - "Pocket Camera", - "Bandai TAMA5", - "Hudson HuC-3", - "Hudson HuC-1" -}; - -void gb_add_cardtype(char *type, ut8 cardcode) { - strcat(type, "\ncard\t"); - switch (cardcode) { - case GB_TAMA5: - case GB_HUC3: - case GB_HUC1: - strcat(type, gb_card_type_str[cardcode - 240]); - break; - case 0x15: - case 0x16: - case 0x17: - strcat(type, "XXX"); - break; - default: - if (cardcode > GB_CAM) { - strcat(type, "XXX"); - return; - } - strcat(type, gb_card_type_str[cardcode]); - break; - } -} - -int gb_get_rombanks(ut8 id) { - switch (id) { - case GB_ROM_BANKS_2: - return 2; - case GB_ROM_BANKS_4: - return 4; - case GB_ROM_BANKS_8: - return 8; - case GB_ROM_BANKS_16: - return 16; - case GB_ROM_BANKS_32: - return 32; - case GB_ROM_BANKS_64: - return 64; - case GB_ROM_BANKS_128: - return 128; - case GB_ROM_BANKS_72: - return 72; - case GB_ROM_BANKS_80: - return 80; - case GB_ROM_BANKS_96: - return 96; - } - return 2; -} - -void gb_get_gbtype(char *type, ut8 foo, ut8 bar) { - if (foo == GB_SGB) { - strcpy(type, "SuperGameboy-Rom"); - } else { - if (bar == GB_GBC) { - strcpy(type, "GameboyColor-Rom"); - } else { - strcpy(type, "Gameboy-Rom"); - } - } -} diff --git a/librz/bin/p/bin_ningb.c b/librz/bin/p/bin_ningb.c index c1f0cd1820..03406b7d44 100644 --- a/librz/bin/p/bin_ningb.c +++ b/librz/bin/p/bin_ningb.c @@ -1,3 +1,5 @@ +// SPDX-FileCopyrightText: 2024 deroad +// SPDX-FileCopyrightText: 2024 maijin // SPDX-FileCopyrightText: 2013-2017 condret // SPDX-License-Identifier: LGPL-3.0-only @@ -8,6 +10,73 @@ #include #include "../format/nin/nin.h" +static const char *gb_get_gameboy_type(ut8 byte0, ut8 byte1) { + if (byte0 == GB_SGB) { + return "SuperGameboy-Rom"; + } else if (byte1 == GB_GBC) { + return "GameboyColor-Rom"; + } + return "Gameboy-Rom"; +} + +static const char *gb_add_card_type(ut8 cardcode) { + switch (cardcode) { + case GB_ROM: return "ROM"; + case GB_ROM_MBC1: return "ROM+MBC1"; + case GB_ROM_MBC1_RAM: return "ROM+MBC1+RAM"; + case GB_ROM_MBC1_RAM_BAT: return "ROM+MBC1+RAM+BATT"; + case GB_ROM_MBC2: return "ROM+MBC2"; + case GB_ROM_MBC2_BAT: return "ROM+MBC2+BATT"; + case GB_ROM_RAM: return "ROM+RAM"; + case GB_ROM_RAM_BAT: return "ROM+RAM+BATT"; + case GB_ROM_MMM01: return "ROM+MMM01"; + case GB_ROM_MMM01_SRAM: return "ROM+MMM01+SRAM"; + case GB_ROM_MMM01_SRAM_BAT: return "ROM+MMM01+SRAM+BATT"; + case GB_ROM_MBC3_TIMER_BAT: return "ROM+MBC3+TIMER+BATT"; + case GB_ROM_MBC3_TIMER_RAM_BAT: return "ROM+MBC3+TIMER+RAM+BATT"; + case GB_ROM_MBC3: return "ROM+MBC3"; + case GB_ROM_MBC3_RAM: return "ROM+MBC3+RAM"; + case GB_ROM_MBC3_RAM_BAT: return "ROM+MBC3+RAM+BATT"; + case GB_ROM_MBC5: return "ROM+MBC5"; + case GB_ROM_MBC5_RAM: return "ROM+MBC5+RAM"; + case GB_ROM_MBC5_RAM_BAT: return "ROM+MBC5+RAM+BATT"; + case GB_ROM_MBC5_RMBL: return "ROM+MBC5+RUMBLE"; + case GB_ROM_MBC5_RMBL_SRAM: return "ROM+MBC5+RUMBLE+SRAM"; + case GB_ROM_MBC5_RMBL_SRAM_BAT: return "ROM+MBC5+RUMBLE+SRAM+BATT"; + case GB_CAM: return "Pocket Camera"; + case GB_TAMA5: return "Bandai TAMA5"; + case GB_HUC3: return "Hudson HuC-3"; + case GB_HUC1: return "Hudson HuC-1"; + default: return NULL; + } +} + +static int gb_get_rombanks(ut8 id) { + switch (id) { + case GB_ROM_BANKS_2: + return 2; + case GB_ROM_BANKS_4: + return 4; + case GB_ROM_BANKS_8: + return 8; + case GB_ROM_BANKS_16: + return 16; + case GB_ROM_BANKS_32: + return 32; + case GB_ROM_BANKS_64: + return 64; + case GB_ROM_BANKS_128: + return 128; + case GB_ROM_BANKS_72: + return 72; + case GB_ROM_BANKS_80: + return 80; + case GB_ROM_BANKS_96: + return 96; + } + return 2; +} + static bool check_buffer(RzBuffer *b) { ut8 lict[sizeof(lic)]; if (rz_buf_read_at(b, 0x104, lict, sizeof(lict)) == sizeof(lict)) { @@ -163,11 +232,16 @@ static RzBinInfo *info(RzBinFile *bf) { return NULL; } rz_buf_read_at(bf->buf, 0x104, rom_header, 76); + + const char *gbtype = gb_get_gameboy_type(rom_header[66], rom_header[63]); + const char *cardtype = gb_add_card_type(rom_header[67]); + + if (cardtype) { + ret->type = rz_str_newf("%s %s", gbtype, cardtype); + } else { + ret->type = rz_str_newf("%s card_%02x", gbtype, (ut32)rom_header[67]); + } ret->file = rz_str_ndup((const char *)&rom_header[48], 16); - ret->type = malloc(128); - ret->type[0] = 0; - gb_get_gbtype(ret->type, rom_header[66], rom_header[63]); - gb_add_cardtype(ret->type, rom_header[67]); // XXX ret->machine = strdup("Gameboy"); ret->os = strdup("any"); ret->arch = strdup("gb");