raphiaura/KytyPS5
1
0
Fork 0
mirror of https://github.com/KytyPS5/KytyPS5.git synced 2026-10-20 19:07:01 +02:00
Code Issues Packages Projects Releases Wiki Activity

audio: prevent ATRAC9 vibration configuration heap corruption

Browse Source
This commit is contained in:
nmzik
2026-09-28 21:17:43 +04:00
parent 4cf456fb77
commit b10bd53dd3
4 changed files with 99 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libs/ajm.cpp
+1 -3
View File
@@ -161,10 +161,8 @@ int KYTY_SYSV_ABI AjmDecAt9ParseConfigData(const void* config_data,
return AJM_ERROR_INVALID_PARAMETER;
}
uint8_t config[ATRAC9_CONFIG_DATA_SIZE] {};
std::memcpy(config, config_data, sizeof(config));
Atrac9CodecInfo codec_info {};
const int init_result = Atrac9InitDecoder(handle, config);
const int init_result = AjmAt9InitDecoder(handle, static_cast<const uint8_t*>(config_data));
const int info_result =
init_result == 0 ? Atrac9GetCodecInfo(handle, &codec_info) : init_result;
Atrac9ReleaseHandle(handle);
src/libs/ajm/atrac9_decoder.h
+14 -1
View File
@@ -18,6 +18,19 @@ extern "C" {
namespace Libs::Audio::Ajm {
inline int AjmAt9InitDecoder(void* handle, const uint8_t* config_data) {
// Keep the guest configuration unchanged for metadata and decoder resets.
uint8_t config[ATRAC9_CONFIG_DATA_SIZE];
std::memcpy(config, config_data, sizeof(config));
const auto channel_config = (config[1] >> 1u) & 7u;
if (channel_config >= 6u) {
// LibAtrac9 lacks vibration layouts; their blocks match ordinary mono/dual-mono.
// Translate only the channel field, preserving the other configuration bits.
config[1] -= 6u << 1u;
}
return Atrac9InitDecoder(handle, config);
}
struct AjmDecAt9InitializeParameters {
uint8_t config_data[ATRAC9_CONFIG_DATA_SIZE];
uint32_t reserved;
@@ -278,7 +291,7 @@ private:
std::memcpy(m_config_data, config_data, ATRAC9_CONFIG_DATA_SIZE);
m_has_config = true;
const int init_ret = Atrac9InitDecoder(m_handle, m_config_data);
const int init_ret = AjmAt9InitDecoder(m_handle, m_config_data);
if (init_ret != 0) {
m_is_initialized = false;
result->result = AJM_RESULT_CODEC_ERROR | AJM_RESULT_INVALID_DATA;
src/libs/ngs2.cpp
+2 -5
View File
@@ -1865,13 +1865,10 @@ static bool Ngs2FourCcEquals(const uint8_t* data, const char* four_cc) {
return std::memcmp(data, four_cc, 4) == 0;
}
static bool Ngs2GetAtrac9CodecInfo(std::array<uint8_t, ATRAC9_CONFIG_DATA_SIZE> config,
static bool Ngs2GetAtrac9CodecInfo(const std::array<uint8_t, ATRAC9_CONFIG_DATA_SIZE>& config,
Atrac9CodecInfo& codec) {
if (config[0] != 0xfe || (config[1] & 1u) != 0 || ((config[1] >> 1u) & 7u) >= 6u) {
return false;
}
void* decoder = Atrac9GetHandle();
const bool valid = decoder != nullptr && Atrac9InitDecoder(decoder, config.data()) == 0 &&
const bool valid = decoder != nullptr && Ajm::AjmAt9InitDecoder(decoder, config.data()) == 0 &&
Atrac9GetCodecInfo(decoder, &codec) == 0 && codec.channels > 0 &&
codec.samplingRate > 0 && codec.superframeSize > 0 &&
codec.framesInSuperframe > 0 && codec.frameSamples > 0 &&