<feed xmlns='http://www.w3.org/2005/Atom'>
<title>dolphin/Source/Core/VideoCommon/CPMemory.h, branch 2603a</title>
<subtitle>GameCube and Wii emulator</subtitle>
<link rel='alternate' type='text/html' href='https://git.dog6.net/dolphin/'/>
<entry>
<title>Fix out of bounds accesses for invalid vertex component formats</title>
<updated>2024-04-04T19:50:34+00:00</updated>
<author>
<name>Pokechu22</name>
<email>Pokechu022@gmail.com</email>
</author>
<published>2024-04-02T04:37:11+00:00</published>
<link rel='alternate' type='text/html' href='https://git.dog6.net/dolphin/commit/?id=a3951dc2d72ebb6f240d592fdbb348137130ce49'/>
<id>a3951dc2d72ebb6f240d592fdbb348137130ce49</id>
<content type='text'>
On all platforms, this would result in out of bounds accesses when getting the component sizes (which uses stuff from VertexLoader_Position.h/VertexLoader_TextCoord.h/VertexLoader_Normal.h). On platforms other than x64 and ARM64, this would also be out of bounds accesses when getting function pointers for the non-JIT vertex loader (in VertexLoader_Position.cpp etc.). Usually both of these would get data from other entries in the same multi-dimensional array, but the last few entries would be truly out of bounds. This does mean that an out of bounds function pointer can be called on platforms that don't have a JIT vertex loader, but it is limited to invalid component formats with values 5/6/7 due to the size of the bitfield the formats come from, so it seems unlikely that this could be exploited in practice.

This issue affects a few games; Def Jam: Fight for New York (https://bugs.dolphin-emu.org/issues/12719) and Fifa Street are known to be affected.

I have not done any hardware testing for this PR specifically, though I *think* I previously determined that at least a value of 5 behaves the same as float (4). That's what I implemented in any case. I did previously determine that both Def Jam: Fight for New York and Fifa Street use an invalid normal format, but don't actually have lighting enabled when that normal vector is used, so it doesn't change rendering in practice.

The color component format also has two invalid values, but VertexLoader_Color.h/.cpp do check for those invalid ones and return a default value instead of doing an out of bounds access.
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
On all platforms, this would result in out of bounds accesses when getting the component sizes (which uses stuff from VertexLoader_Position.h/VertexLoader_TextCoord.h/VertexLoader_Normal.h). On platforms other than x64 and ARM64, this would also be out of bounds accesses when getting function pointers for the non-JIT vertex loader (in VertexLoader_Position.cpp etc.). Usually both of these would get data from other entries in the same multi-dimensional array, but the last few entries would be truly out of bounds. This does mean that an out of bounds function pointer can be called on platforms that don't have a JIT vertex loader, but it is limited to invalid component formats with values 5/6/7 due to the size of the bitfield the formats come from, so it seems unlikely that this could be exploited in practice.

This issue affects a few games; Def Jam: Fight for New York (https://bugs.dolphin-emu.org/issues/12719) and Fifa Street are known to be affected.

I have not done any hardware testing for this PR specifically, though I *think* I previously determined that at least a value of 5 behaves the same as float (4). That's what I implemented in any case. I did previously determine that both Def Jam: Fight for New York and Fifa Street use an invalid normal format, but don't actually have lighting enabled when that normal vector is used, so it doesn't change rendering in practice.

The color component format also has two invalid values, but VertexLoader_Color.h/.cpp do check for those invalid ones and return a default value instead of doing an out of bounds access.
</pre>
</div>
</content>
</entry>
<entry>
<title>VertexLoaderTest: Add test for skipped texture coordinates</title>
<updated>2023-12-02T23:54:52+00:00</updated>
<author>
<name>Pokechu22</name>
<email>Pokechu022@gmail.com</email>
</author>
<published>2023-12-02T23:39:43+00:00</published>
<link rel='alternate' type='text/html' href='https://git.dog6.net/dolphin/commit/?id=1ee6824324979b186baca2b5266be9c20e88c78a'/>
<id>1ee6824324979b186baca2b5266be9c20e88c78a</id>
<content type='text'>
Jimmie Johnson's Anything with an Engine is known to use texture coordinate 7 (and only texture coordinate 7) in some cases. There are a lot of possible edge-cases, so this test brute-forces all combinations with coordinates 0, 1, and 2.
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Jimmie Johnson's Anything with an Engine is known to use texture coordinate 7 (and only texture coordinate 7) in some cases. There are a lot of possible edge-cases, so this test brute-forces all combinations with coordinates 0, 1, and 2.
</pre>
</div>
</content>
</entry>
<entry>
<title>Simplify saving CP state</title>
<updated>2022-10-10T02:32:59+00:00</updated>
<author>
<name>Pokechu22</name>
<email>Pokechu022@gmail.com</email>
</author>
<published>2022-10-07T19:25:04+00:00</published>
<link rel='alternate' type='text/html' href='https://git.dog6.net/dolphin/commit/?id=ffed23c059f52dfbe1dbd089d6861c68b8960035'/>
<id>ffed23c059f52dfbe1dbd089d6861c68b8960035</id>
<content type='text'>
Rather than makring some parts of VertexLoaderManager dirty in some places and some in others, do it all in VideoState. Also, since CPState no longer contains pointers/non-CP data after d039b1bc0dfaba2a88036468b6d971bb1d7e463d, we can just use p.Do on it instead of manually saving each field.
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Rather than makring some parts of VertexLoaderManager dirty in some places and some in others, do it all in VideoState. Also, since CPState no longer contains pointers/non-CP data after d039b1bc0dfaba2a88036468b6d971bb1d7e463d, we can just use p.Do on it instead of manually saving each field.
</pre>
</div>
</content>
</entry>
<entry>
<title>Rename CP and XF normal component count enums and update their descriptions</title>
<updated>2022-05-18T21:43:14+00:00</updated>
<author>
<name>Pokechu22</name>
<email>Pokechu022@gmail.com</email>
</author>
<published>2022-05-17T18:54:24+00:00</published>
<link rel='alternate' type='text/html' href='https://git.dog6.net/dolphin/commit/?id=46bcdc4372209f343ff28994770c0666a0d6c3ac'/>
<id>46bcdc4372209f343ff28994770c0666a0d6c3ac</id>
<content type='text'>
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
</pre>
</div>
</content>
</entry>
<entry>
<title>Fix ambiguous uses of format_to</title>
<updated>2022-01-13T19:11:08+00:00</updated>
<author>
<name>Pokechu22</name>
<email>Pokechu022@gmail.com</email>
</author>
<published>2022-01-13T06:52:21+00:00</published>
<link rel='alternate' type='text/html' href='https://git.dog6.net/dolphin/commit/?id=5465775d119bbfb5aa1862e4fc5cb8a7fa015e5a'/>
<id>5465775d119bbfb5aa1862e4fc5cb8a7fa015e5a</id>
<content type='text'>
At least in MSVC (which is not restricted from targetting C++20), these can be resolved to either std::format_to or fmt::format_to (though I'm not sure why the std one is available).  We want the latter.
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
At least in MSVC (which is not restricted from targetting C++20), these can be resolved to either std::format_to or fmt::format_to (though I'm not sure why the std one is available).  We want the latter.
</pre>
</div>
</content>
</entry>
<entry>
<title>Make all fmt::formatter constructors constexpr</title>
<updated>2022-01-13T19:11:08+00:00</updated>
<author>
<name>Pokechu22</name>
<email>Pokechu022@gmail.com</email>
</author>
<published>2022-01-13T01:28:17+00:00</published>
<link rel='alternate' type='text/html' href='https://git.dog6.net/dolphin/commit/?id=ac46b91673adae121e48bb6beedfb5b61339c39b'/>
<id>ac46b91673adae121e48bb6beedfb5b61339c39b</id>
<content type='text'>
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
</pre>
</div>
</content>
</entry>
<entry>
<title>Make all custom fmt::formatter's format functions const</title>
<updated>2022-01-13T19:11:08+00:00</updated>
<author>
<name>Pokechu22</name>
<email>Pokechu022@gmail.com</email>
</author>
<published>2022-01-13T01:16:29+00:00</published>
<link rel='alternate' type='text/html' href='https://git.dog6.net/dolphin/commit/?id=78e43a44042e6407318970753df4d3b5b230e80c'/>
<id>78e43a44042e6407318970753df4d3b5b230e80c</id>
<content type='text'>
fmt 8.0.0 requires this.
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
fmt 8.0.0 requires this.
</pre>
</div>
</content>
</entry>
<entry>
<title>VideoCommon: Move VertexLoaderManager logic out of CPState</title>
<updated>2021-12-18T23:21:48+00:00</updated>
<author>
<name>Pokechu22</name>
<email>Pokechu022@gmail.com</email>
</author>
<published>2021-05-13T23:05:31+00:00</published>
<link rel='alternate' type='text/html' href='https://git.dog6.net/dolphin/commit/?id=d039b1bc0dfaba2a88036468b6d971bb1d7e463d'/>
<id>d039b1bc0dfaba2a88036468b6d971bb1d7e463d</id>
<content type='text'>
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
</pre>
</div>
</content>
</entry>
<entry>
<title>Refactor OpcodeDecoding and FIFO analyzer to use callbacks</title>
<updated>2021-12-18T23:21:36+00:00</updated>
<author>
<name>Pokechu22</name>
<email>Pokechu022@gmail.com</email>
</author>
<published>2021-04-23T03:57:56+00:00</published>
<link rel='alternate' type='text/html' href='https://git.dog6.net/dolphin/commit/?id=b5fd35f95145ecc8f88a179229ed69b390eb76be'/>
<id>b5fd35f95145ecc8f88a179229ed69b390eb76be</id>
<content type='text'>
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
</pre>
</div>
</content>
</entry>
<entry>
<title>Create and use CPArray enum class</title>
<updated>2021-12-18T20:51:56+00:00</updated>
<author>
<name>Pokechu22</name>
<email>Pokechu022@gmail.com</email>
</author>
<published>2021-06-20T20:47:57+00:00</published>
<link rel='alternate' type='text/html' href='https://git.dog6.net/dolphin/commit/?id=1914087998bc296208355dc4b1b2553430b081b2'/>
<id>1914087998bc296208355dc4b1b2553430b081b2</id>
<content type='text'>
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
</pre>
</div>
</content>
</entry>
</feed>
