From 568781bc7ea3e7e40749dcb8e299acf2f8bf9cb5 Mon Sep 17 00:00:00 2001 From: TuxSH Date: Thu, 1 Mar 2018 12:30:24 +0100 Subject: [PATCH] Strongly validate SPL's buffer address --- exosphere/src/userpage.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/exosphere/src/userpage.c b/exosphere/src/userpage.c index a57aa8fd9..1a4b4dadb 100644 --- a/exosphere/src/userpage.c +++ b/exosphere/src/userpage.c @@ -24,8 +24,8 @@ bool upage_init(upage_ref_t *upage, void *user_address) { } upage->secure_monitor_address = USER_PAGE_SECURE_MONITOR_ADDR; } else { - /* Weakly validate SPL's physically random address is in DRAM. */ - if (upage->user_address >> 31) { + /* Validate SPL's physically random address (must be in DRAM (supports up to 6GB, retail console have 4GB) and page-aligned). */ + if ((upage->user_address - 0x80000000ull) < (6ull << 30) && ((uintptr_t)user_address & 0xFFF) == 0) { static const uint64_t userpage_attributes = MMU_PTE_BLOCK_XN | MMU_PTE_BLOCK_INNER_SHAREBLE | MMU_PTE_BLOCK_NS | ATTRIB_MEMTYPE_NORMAL; uintptr_t *mmu_l3_tbl = (uintptr_t *)TZRAM_GET_SEGMENT_ADDRESS(TZRAM_SEGMENT_ID_L3_TRANSLATION_TABLE); g_user_page_user_address = upage->user_address;