fix(libkernel): refuse read-only guest mappings for getdirentries on Windows

core/libs/prx/libkernel/File/src/Stdio.cpp

@@ -1025,6 +1025,9 @@ int APS5_VABI sceKernelGetdirentries(int fd, char* buf, int nbytes, int64_t* bas
         if (WithoutParameterHandler([fd] { return ::_get_osfhandle(fd); }) == -1) return SceErrorFromErrno(GUEST_EBADF);
         return SceErrorFromErrno(GUEST_EINVAL);
     }
+    const GuestArena::HostWrite destination(buf, static_cast<std::size_t>(nbytes));
+    const GuestArena::HostWrite baseDestination(basep, basep == nullptr ? 0 : sizeof(*basep));
+    if (!destination.Open() || !baseDestination.Open()) return SceErrorFromErrno(GUEST_EFAULT);
     if (basep != nullptr) *basep = 0;
     return File::ReadDirectoryDescriptor(fd, buf, nbytes);
 }
@@ -1045,6 +1048,9 @@ int APS5_VABI sceKernelGetdirentries(int fd, char* buf, int nbytes, int64_t* bas
     struct stat status{};
     if (::fstat(fd, &status) != 0) return SceErrorFromErrno(errno);
     if (!S_ISDIR(status.st_mode)) return SceErrorFromErrno(GUEST_EINVAL);
+    const GuestArena::HostWrite destination(buf, static_cast<std::size_t>(nbytes));
+    const GuestArena::HostWrite baseDestination(basep, basep == nullptr ? 0 : sizeof(*basep));
+    if (!destination.Open() || !baseDestination.Open()) return SceErrorFromErrno(GUEST_EFAULT);
     const off_t base = ::lseek(fd, 0, SEEK_CUR);
     if (base < 0) return SceErrorFromErrno(errno);
     if (basep != nullptr) *basep = static_cast<int64_t>(base);

core/libs/tests/GuestDirectoryBuffer.cpp

@@ -18,6 +18,11 @@ int APS5_VABI sceKernelOpen(const char*, int, std::uint16_t);
 int APS5_VABI sceKernelClose(int);
 int APS5_VABI sceKernelGetdents(int, char*, int);
 int APS5_VABI sceKernelGetdirentries(int, char*, int, std::int64_t*);
+int APS5_VABI sceKernelAllocateDirectMemory(std::int64_t, std::int64_t, std::size_t, std::size_t, int, std::int64_t*);
+int APS5_VABI sceKernelMapDirectMemory(void**, std::size_t, int, int, std::int64_t, std::size_t);
+int APS5_VABI sceKernelMprotect(void*, std::size_t, int);
+int APS5_VABI sceKernelMunmap(void*, std::size_t);
+int APS5_VABI sceKernelReleaseDirectMemory(std::int64_t, std::size_t);
 }
 
 static void Check(bool value, int line) {
@@ -91,6 +96,33 @@ static void CheckOversizedName() {
     std::filesystem::remove_all(root);
 }
 
+static void CheckReadOnlyDestination() {
+    constexpr std::size_t page = 0x4000;
+    const auto root = std::filesystem::temp_directory_path() /
+        ("anyps5-directory-readonly-" + std::to_string(std::chrono::steady_clock::now().time_since_epoch().count()));
+    Require(std::filesystem::create_directory(root));
+    { std::ofstream file(root / "entry.bin"); Require(static_cast<bool>(file)); }
+    const int directory = sceKernelOpen(root.string().c_str(), SCE_KERNEL_O_RDONLY | SCE_KERNEL_O_DIRECTORY, 0);
+    Require(directory >= 0);
+    std::int64_t physical = 0;
+    Require(sceKernelAllocateDirectMemory(0, 0x7fffffffffll, page, 0, 0, &physical) == 0);
+    void* mapping = nullptr;
+    Require(sceKernelMapDirectMemory(&mapping, page, 3, 0, physical, 0) == 0 && mapping != nullptr);
+    std::int64_t base = -1;
+    Require(sceKernelGetdirentries(directory, static_cast<char*>(mapping), 4096, &base) > 0);
+    Require(sceKernelMprotect(mapping, page, 1) == 0);
+    Require(sceKernelGetdirentries(directory, static_cast<char*>(mapping), 4096, &base) == SCE_KERNEL_ERROR_EFAULT);
+    Require(sceKernelGetdirentries(12345, static_cast<char*>(mapping), 4096, &base) == SCE_KERNEL_ERROR_EBADF);
+    std::array<char, 512> buffer{};
+    Require(sceKernelGetdirentries(directory, buffer.data(), static_cast<int>(buffer.size()),
+        static_cast<std::int64_t*>(mapping)) == SCE_KERNEL_ERROR_EFAULT);
+    Require(sceKernelMprotect(mapping, page, 3) == 0);
+    Require(sceKernelMunmap(mapping, page) == 0);
+    Require(sceKernelReleaseDirectMemory(physical, page) == 0);
+    Require(sceKernelClose(directory) == 0);
+    std::filesystem::remove_all(root);
+}
+
 int main() {
     CheckName(u8"a-long-directory-entry-name.bin");
     CheckName(u8"caf\u00e9-music.bin");
@@ -100,4 +132,5 @@ int main() {
     for (int i = 0; i < 85; ++i) longest += u8"\u30bb";
     CheckName(longest);
     CheckOversizedName();
+    CheckReadOnlyDestination();
 }