Claude
dbce646e7b
fix(libc): keep guest environment strings alive across setenv and unsetenv
...
setenv replaced a variable's string with a new allocation and freed the
old one, and unsetenv freed it as well, so a pointer that getenv had
returned for that variable dangled. A guest that reads such a pointer
after setenv(name, value, 1) reads freed host memory: AddressSanitizer
reports a heap-use-after-free on that read.
FreeBSD 11.4's getenv.c, which holds the setenv, unsetenv and putenv the
console's libc exports next to getenv, never frees a variable's string
("No previous variables are ever freed here to avoid causing a
segmentation fault in a user's code", lib/libc/stdlib/getenv.c lines
449-520 at 8c639945a4). setenv and unsetenv mark the old string
inactive; setenv writes the new value over the latest string of that
name when the value fits and allocates a new string otherwise; putenv
strings stay the caller's and are only forgotten.
The guest environment now keeps every string it allocates with its value
capacity and an active flag and follows that code: getenv and the time
zone lookup read the name's latest active string, setenv reuses the
latest string of the name when it fits, an unset one included, and
otherwise appends a new one and deactivates the old, putenv replaces an
earlier putenv string or deactivates the setenv one, and unsetenv
deactivates them all. Built on the host next to this library, FreeBSD's
getenv.c gave the same results, errno, pointer reuse and contents of
every earlier pointer over 160,000 random calls once the putenv flag it
leaves uninitialized in new setenv strings was cleared; the debt entry
records that the console may allocate where this reuses.
guest_environment checks the reuse, that earlier values stay readable
after a longer setenv and after unsetenv, and that putenv and setenv
leave each other's strings alone.
Co-Authored-By: Claude Opus 5.5 <[email protected] https://claude.ai/code/session_01DXPnhogDW4zpeNCBro4Ctt
2026-10-27 17:39:23 +00:00
Adrià
254240c747
Merge pull request #11045 from roboterspinne/fix/relinker-macos-fixups-writable
...
fix(relinker): reject macOS fixups outside writable segments
2026-10-27 18:29:51 +01:00
Dean
594214f733
Merge pull request #11357 from oneandonlydean/sa/host-import-frame-eviction
...
fix(agc): do not evict host imports used in the current or previous frame
2026-10-28 06:23:09 +13:00
Dean
f188470bca
Merge pull request #11757 from milescoviello/docs/livestreaming-status-reads
...
docs(libSceGameLiveStreaming): note the status fields three titles read
2026-10-28 06:02:30 +13:00
Dean
0c4a8cb41a
Merge pull request #11756 from milescoviello/docs/signin-dialog-result-callers
...
docs(libSceSigninDialog): note the result size and field three titles use
2026-10-28 06:01:55 +13:00
Adrià
e0cd1259a9
Merge pull request #11254 from Michael-KD/fix/scalar-buffer-runtime-word3
...
fix(shader): ignore a runtime V#'s type for scalar buffer loads as RDNA2 does
2026-10-27 16:28:28 +01:00
Adrià
637522b6bf
Merge pull request #11083 from slopgobblercobbler/fix/savedata-convert-null-parameter-validation
...
fix(libSceSaveData.native): return SAVE_DATA_ERROR_PARAMETER on null argument in sceSaveDataConvert
2026-10-27 16:21:11 +01:00
Adrià
6f7cb75291
Merge pull request #9193 from imellag/feat/shader-barycentric-builtins-moltenvk
...
feat(recompiler): read I/J from barycentric built-ins on MoltenVK
2026-10-27 16:21:05 +01:00
Adrià
e2a5118839
Merge pull request #11047 from imellag/feat/libkernel-macho-tls
...
feat(libkernel): thread-local storage for Mach-O guests
2026-10-27 15:18:46 +01:00
Dean
75f3702aed
Merge pull request #11763 from oneandonlydean/salvage/common-dialog-9623
...
feat(libSceCommonDialog): declare 14 pending exports
2026-10-28 02:34:54 +13:00
Adrià
a40ad89e2c
Merge pull request #11236 from orezraey/fix/libkernel-kqueue-timer-readd-measured-ps5
...
fix(libkernel): accept EVFILT_TIMER re-adds with a time unit or on a disabled timer as measured on a PS5
2026-10-27 14:28:05 +01:00
Adrià
1089f2bbfd
Merge pull request #11039 from orezraey/fix/libkernel-mutex-yieldloops-destroyed-measured-ps5
...
fix(libkernel): fail the yield loop setter on a destroyed mutex as measured on a PS5
2026-10-27 14:08:31 +01:00
Adrià
9de9c6efd0
Merge pull request #11261 from JaceTheBlu/feat/libressl-object-text
...
feat(libSceLibreSsl): add the LibreSSL object table and implement i2t_ASN1_OBJECT
2026-10-27 14:07:27 +01:00
Adrià
b71d5db752
Merge pull request #10855 from Felipebmaitan/feat/async-storage-engine
...
fix(libkernel): preserve AIO request ownership and identities
2026-10-27 13:30:47 +01:00
Adrià
eece5da035
Merge pull request #10838 from EagleBearerYS/feat/libkernel-sys-finish-calls-v2
...
feat(libkernel_sys): finish sched_setscheduler and sigreturn
2026-10-27 13:20:31 +01:00
Adrià
9ae2f7d22a
Merge pull request #10414 from orezraey/fix/agc-partial-fast-clear-eliminate
...
fix(agc): eliminate a fast clear over part of a CMASK color target
2026-10-27 13:19:27 +01:00
Adrià
431a5156b9
Merge pull request #11716 from milescoviello/docs/avplayer-init-allocators
...
docs(libSceAvPlayer): note that six titles pass all four allocator callbacks
2026-10-27 13:02:54 +01:00
Adrià
ca0e9557aa
Merge pull request #11697 from milescoviello/docs/savedata-prepare-silent
...
docs(libSceSaveData.native): list sceSaveDataPrepare and sceSaveDataCommit as silent stubs and note how six titles use their results
2026-10-27 12:36:14 +01:00
Adrià
8ff4baf534
Merge pull request #11656 from dantdmdarealguy/docs/netctl-aprp-stale-debt
...
docs(debt): drop the stale ApRp stub note from libSceNetCtl
2026-10-27 12:01:31 +01:00
Adrià
d410ce253f
Merge pull request #11207 from EagleBearerYS/feat/imedialog-pad-keyboard
...
feat(libSceImeDialog): type with the controller on an on-screen keyboard
2026-10-27 12:00:58 +01:00
Adrià
9165e8722e
Merge pull request #10536 from noamroger/claude/project-thread-3146bi
...
feat(libSceHttp2): implement request option getters, header removal a…
2026-10-27 12:00:52 +01:00
Adrià
768e92f8b6
Merge pull request #9743 from frankea/fix/hull-reads-control-point-outputs
...
fix(shader): read other control points' off-chip outputs in hull programs
2026-10-27 12:00:31 +01:00
Adrià
2635028370
Merge pull request #11061 from roboterspinne/fix/relinker-red-zone-body-pushes
...
fix(relinker): refuse red-zone leaves without a frame pointer that push or pop
2026-10-27 12:00:25 +01:00
Adrià
6a5950b5ce
Merge pull request #10903 from imellag/test/libc-update-env-macos
...
test(libc): run the feupdateenv checks on macOS and under Rosetta 2
2026-10-27 12:00:19 +01:00
Adrià
a49b5aa216
Merge pull request #11496 from milescoviello/docs/videoout-open-call-sites
...
docs(libSceVideoOut): note how seven titles call sceVideoOutOpen
2026-10-27 12:00:07 +01:00
Adrià
e4f6c8aa40
Merge pull request #11453 from LeandroLP23/docs/agc-present-mutex-amd-windows
...
docs(agc): record presentation under the GPU mutex on AMD's Windows driver
2026-10-27 11:59:57 +01:00
Adrià
843840167e
Merge pull request #11392 from PrivacyOnion/docs/debt-companionutil-stubs
...
docs(debt): record silent stubs in libSceCompanionUtil debt
2026-10-27 11:59:46 +01:00
Adrià
d68d7546bf
Merge pull request #11390 from PrivacyOnion/docs/debt-playgodialog-stubs
...
docs(debt): record silent stubs in libScePlayGoDialog debt
2026-10-27 11:59:40 +01:00
Adrià
c298342798
Merge pull request #11389 from PrivacyOnion/docs/debt-signindialog-stubs
...
docs(debt): record silent stubs in libSceSigninDialog debt
2026-10-27 11:59:36 +01:00
Adrià
699c908f67
Merge pull request #11387 from PrivacyOnion/docs/debt-share-stubs
...
docs(debt): record silent stubs in libSceShare debt
2026-10-27 11:59:30 +01:00
Adrià
fc5ba20796
Merge pull request #11385 from PrivacyOnion/docs/debt-savedatadialog-stubs
...
docs(debt): record sceSaveDataDialogIsReadyToDisplay stub in libSceSaveDataDialog.native debt
2026-10-27 11:59:25 +01:00
Adrià
4f7e120148
Merge pull request #11386 from PrivacyOnion/docs/debt-fsinternalforvsh-stubs
...
docs(debt): record silent stubs in libSceFsInternalForVsh debt
2026-10-27 11:59:20 +01:00
Adrià
2222ab420f
Merge pull request #11384 from PrivacyOnion/docs/debt-composite-stubs
...
docs(debt): record silent stubs in libSceComposite debt
2026-10-27 11:59:15 +01:00
Adrià
f14b520f27
Merge pull request #11383 from PrivacyOnion/docs/debt-movetracker-stubs
...
docs(debt): record silent stubs in libSceMoveTracker debt
2026-10-27 11:59:09 +01:00
Adrià
57decaef35
Merge pull request #11378 from PrivacyOnion/docs/debt-mdbg-syscore-stubs
...
docs(debt): record silent stubs in libmdbg_syscore debt
2026-10-27 11:58:58 +01:00
Adrià
61e96fecbd
Merge pull request #11377 from PrivacyOnion/docs/debt-remoteplay-stubs
...
docs(debt): record silent stubs in libSceRemoteplay debt
2026-10-27 11:58:53 +01:00
Adrià
4bf2b03534
Merge pull request #11373 from PrivacyOnion/docs/debt-automounterclient-stubs
...
docs(debt): document sceAutoMounterClientInit and device list debt
2026-10-27 11:58:48 +01:00
Adrià
5c3c9d95c8
Merge pull request #11364 from xXPBSXx/fix-agc-cb-resolve-packed-float
...
docs(debt): record the unsupported and unmeasured multisample CB resolve of 11_11_10 float targets
2026-10-27 11:58:43 +01:00
Dean
5d52b06ff3
Merge pull request #9324 from MarrasFederico/feat/ngs2-parse-format-codes
...
fix(libSceNgs2.native): return 0x804A8432 for waveform formats the module does not parse
2026-10-27 21:35:03 +13:00
Dean
77f68f314b
Merge pull request #11560 from Ragbie/fix/write-after-read-update-stream
...
fix(libc): set up streams for writing after a read as FreeBSD does on Windows
2026-10-27 21:27:48 +13:00
Dean
c28cf99512
Merge pull request #11438 from p3n1cillin/claude/direct-map-refuses-execute
...
fix(libkernel): refuse to map direct memory with execute as the console does
2026-10-27 21:26:17 +13:00
Dean
1d46b76e97
Merge pull request #11379 from Terminev/feat/invitation-dialog-offline
...
feat(libSceInvitationDialog): finish the PS4 invitation dialog as canceled without a window
2026-10-27 21:24:33 +13:00
Dean
f9b2db1d41
Merge pull request #11269 from Gruzzberry/fix/realpath-symlinks
...
fix(libc): realpath resolves symbolic links like FreeBSD
2026-10-27 21:22:09 +13:00
Dean
be9aa82d38
Merge pull request #11235 from AlexFigas/feat/npcppwebapi-never-started-transactions
...
fix(libSceNpCppWebApi): answer finish, abort and getId for never-started transactions as the module does
2026-10-27 21:21:53 +13:00
Dean
066fead614
Merge pull request #11165 from atharvjairath/feat/libressl3-key-references
...
feat(libressl3): retain EVP and EC key references
2026-10-27 21:21:14 +13:00
Dean
e07c21ce68
Merge pull request #11157 from janzezno/feat/agc-frame-capture-linux
...
feat(agc): capture and replay frames on Linux
2026-10-27 21:20:55 +13:00
Dean
d5f7d86ccc
Merge pull request #11139 from JJenkx/fix/libc-modf-floating-environment
...
fix(libc): preserve modf decomposition and floating-point status
2026-10-27 21:20:33 +13:00
Dean
1e5e1d56fb
Merge pull request #11110 from orezraey/fix/libscertc-settime-t-order-measured-ps5
...
fix(libSceRtc): check the seconds before the pointer in sceRtcSetTime_t as measured on a PS5
2026-10-27 21:19:24 +13:00
Dean
6f7fba5bfa
Merge pull request #11086 from slopgobblercobbler/fix/agc-submit-many-bounds-validation
...
fix(agc): validate multi-submit count overflow and null command buffers
2026-10-27 21:19:00 +13:00
Dean
d090e62841
Merge pull request #11074 from JJenkx/fix/libc-frexpf-floating-environment
...
fix(libc): preserve frexpf decomposition and exception behavior
2026-10-27 21:18:34 +13:00
Claude