[XAM] Fixed potential OOB memory write in copy utils

This commit is contained in:
Adrian
2026-05-13 12:48:16 +01:00
committed by Radosław Gliński
parent 92ada8ebc0
commit 907d92bf8c
4 changed files with 8 additions and 5 deletions

View File

@@ -499,7 +499,7 @@ bool ProfileManager::CreateAccount(const uint64_t xuid,
const std::u16string gamertag_u16 = xe::to_utf16(gamertag);
string_util::copy_and_swap_truncating(account.gamertag, gamertag_u16,
sizeof(account.gamertag));
xe::countof(account.gamertag));
const bool result = UpdateAccount(xuid, &account);
DismountProfile(xuid);

View File

@@ -204,8 +204,9 @@ dword_result_t keXamBuildResourceLocator(uint64_t module,
path = fmt::format(u"section://{:X},{}#{}", (uint32_t)module, container,
resource);
}
const uint32_t char_count = buffer_count / sizeof(char16_t);
xe::string_util::copy_and_swap_truncating(buffer_ptr.as<char16_t*>(), path,
buffer_count);
char_count);
return 0;
}

View File

@@ -496,7 +496,8 @@ void XFormatDateString(uint64_t filetime, uint32_t buffer_address,
static_cast<unsigned>(year_month_day.month()),
static_cast<unsigned>(year_month_day.day()),
static_cast<int>(year_month_day.year()));
xe::string_util::copy_and_swap_truncating(buffer, str, buffer_size);
const uint32_t char_count = buffer_size / sizeof(char16_t);
xe::string_util::copy_and_swap_truncating(buffer, str, char_count);
}
void XamFormatDateString_entry(dword_t locale_format, qword_t filetime,
@@ -523,7 +524,8 @@ void XFormatTimeString(uint64_t filetime, uint32_t buffer_address,
auto str = fmt::format(u"{:02d}:{:02d}", time.hours().count(),
time.minutes().count());
xe::string_util::copy_and_swap_truncating(buffer, str, buffer_size);
const uint32_t char_count = buffer_size / sizeof(char16_t);
xe::string_util::copy_and_swap_truncating(buffer, str, char_count);
}
void XamFormatTimeString_entry(dword_t user_index, qword_t filetime,

View File

@@ -474,7 +474,7 @@ dword_result_t XamShowKeyboardUI_entry(
assert_not_null(overlapped);
auto buffer_size = static_cast<size_t>(buffer_length) * 2;
auto buffer_size = static_cast<size_t>(buffer_length) * sizeof(char16_t);
X_RESULT result;
if (cvars::headless) {