fabi/Xenia-Canary
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[XAM] Fixed XEnumerateCrossTitle corrupt items_returned_ptr

Browse Source 
Fixed Halo: Reach from crashing when accessing The Armory
This commit is contained in:
Adrian
2025-11-22 20:28:10 +00:00
committed by Radosław Gliński
parent d915dd808d
commit 07501cfcb9
3 changed files with 27 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
src/xenia/kernel/xam/apps/xam_app.cc
View File

@@ -64,11 +64,11 @@ X_HRESULT XamApp::DispatchMessageSync(uint32_t message, uint32_t buffer_ptr,
assert_true(enum_struct->magic == kXObjSignature); assert_true(enum_struct->magic == kXObjSignature);
// This is a struct of XCONTENT_AGGREGATE_DATA // This is a struct of XCONTENT_DATA_INTERNAL
uint8_t* content_data_ptr = uint8_t* content_data_ptr =
memory_->TranslateVirtual<uint8_t*>(data_ptr->buffer_ptr); memory_->TranslateVirtual<uint8_t*>(data_ptr->buffer_ptr);
assert_true(data_ptr->buffer_size == sizeof(XCONTENT_AGGREGATE_DATA)); assert_true(data_ptr->buffer_size == sizeof(XCONTENT_DATA_INTERNAL));
std::memset(content_data_ptr, 0, data_ptr->buffer_size); std::memset(content_data_ptr, 0, data_ptr->buffer_size);
@@ -77,11 +77,11 @@ X_HRESULT XamApp::DispatchMessageSync(uint32_t message, uint32_t buffer_ptr,
result = X_HRESULT_FROM_WIN32(result); result = X_HRESULT_FROM_WIN32(result);
if (result == X_E_SUCCESS && data_ptr->items_returned_ptr && xe::be<uint32_t>* items_returned_ptr =
item_count >= 1) { memory_->TranslateVirtual<xe::be<uint32_t>*>(
xe::store_and_swap<uint32_t>( data_ptr->items_returned_ptr);
memory_->TranslateVirtual(data_ptr->items_returned_ptr), 1);
} *items_returned_ptr = item_count;
return result; return result;
} }

6
src/xenia/kernel/xam/content_manager.h
View File

@@ -119,6 +119,12 @@ struct XCONTENT_AGGREGATE_DATA : XCONTENT_DATA {
}; };
static_assert_size(XCONTENT_AGGREGATE_DATA, 0x148); static_assert_size(XCONTENT_AGGREGATE_DATA, 0x148);
struct XCONTENT_CROSS_TITLE_DATA {
XCONTENT_DATA content_data;
xe::be<uint32_t> title_id;
};
static_assert_size(XCONTENT_CROSS_TITLE_DATA, 0x138);
struct XCONTENT_DATA_MEDIA { struct XCONTENT_DATA_MEDIA {
be<uint8_t> series_id[0x10]; // 0x0 sz:0x10 be<uint8_t> series_id[0x10]; // 0x0 sz:0x10
be<uint8_t> seasonid[0x10]; // 0x10 sz:0x10 be<uint8_t> seasonid[0x10]; // 0x10 sz:0x10

19
src/xenia/kernel/xam/xam_content_aggregate.cc
View File

@@ -89,7 +89,7 @@ dword_result_t XamContentAggregateCreateEnumerator_entry(qword_t xuid,
return X_E_INVALIDARG; return X_E_INVALIDARG;
} }
auto e = make_object<XStaticEnumerator<XCONTENT_AGGREGATE_DATA>>( auto e = make_object<XStaticEnumerator<XCONTENT_CROSS_TITLE_DATA>>(
kernel_state(), 1); kernel_state(), 1);
X_KENUMERATOR_CONTENT_AGGREGATE* extra; X_KENUMERATOR_CONTENT_AGGREGATE* extra;
auto result = e->Initialize(XUserIndexAny, 0xFE, 0x2000E, 0x20010, 0, &extra); auto result = e->Initialize(XUserIndexAny, 0xFE, 0x2000E, 0x20010, 0, &extra);
@@ -125,15 +125,24 @@ dword_result_t XamContentAggregateCreateEnumerator_entry(qword_t xuid,
auto item = e->AppendItem(); auto item = e->AppendItem();
assert_not_null(item); assert_not_null(item);
if (item) { if (item) {
*item = content_data; item->content_data.device_id = content_data.device_id;
item->content_data.content_type = content_data.content_type;
item->content_data.display_name_raw = content_data.display_name_raw;
std::memcpy(item->content_data.file_name_raw,
content_data.file_name_raw,
sizeof(content_data.file_name_raw));
item->content_data.padding[0] = 0;
item->content_data.padding[1] = 0;
item->title_id = content_data.title_id;
} }
} }
} }
} }
if (!device_info || device_info->device_type == DeviceType::ODD) { // if (!device_info || device_info->device_type == DeviceType::ODD) {
AddODDContentTest(e, content_type_enum); // AddODDContentTest(e, content_type_enum);
} // }
XELOGD("XamContentAggregateCreateEnumerator: added {} items to enumerator", XELOGD("XamContentAggregateCreateEnumerator: added {} items to enumerator",
e->item_count()); e->item_count());