Skip to content

fself: don't read before the ELF when .sceversion is missing - #175

Open
TheErsysEnding wants to merge 1 commit into
ps3dev:masterfrom
TheErsysEnding:fself-missing-sceversion
Open

TheErsysEnding wants to merge 1 commit into
ps3dev:masterfrom
TheErsysEnding:fself-missing-sceversion

Conversation

@TheErsysEnding

Copy link
Copy Markdown

Problem

On Apple Silicon macOS, fself crashes with SIGBUS on every program built with the PSL1GHT rules. That stops make at the .self step:

make[1]: *** [.../app.self] Bus error: 10

self_build_sceversion_header() looks up the .sceversion section, but ELFs built with ppu_rules don't have one. elf_get_shstr_off() then returns -1, and the function calls strlen((char*)elf_data - 1). AddressSanitizer reports:

ERROR: AddressSanitizer: heap-buffer-overflow ... READ of size 1
    #1 self_build_sceversion_header self.c:308
0x... is located 1 bytes before 813480-byte region

On Linux the stray read usually goes unnoticed. The fake SELF then carries a bogus section_idx, offset and str_size in its SCE version header.

Fix

When the section is missing, the function now returns right after setting the constant fields. section_idx, offset and str_size stay at zero, because the struct is already memset to 0.

Testing

Tested on macOS 27 on Apple Silicon, with the toolchain from ps3toolchain master:

ELF before after
built with ppu_rules (no .sceversion) SIGBUS (exit 138) exit 0, ASan/UBSan clean
same ELF with a .sceversion section added via ppu-objcopy --add-section exit 0 exit 0, output byte-identical to before

🤖 Generated with Claude Code

elf_get_shstr_off() returns -1 when a section does not exist, and
self_build_sceversion_header() then ran strlen() on elf_data - 1. ELFs
built with the PSL1GHT rules have no .sceversion section, so this
happened on every build. On Linux the stray read usually goes unnoticed
and leaves a bogus offset and size in the fake SELF; on Apple Silicon
macOS fself dies with SIGBUS, which stops "make" at the .self step.

Leave section_idx, offset and str_size at zero when the section is
absent. ELFs that do have the section produce the same output as before.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant