gzorin / rsxgl Goto Github PK

So, I am trying to get 3D acceleration working under linux on the PS3. Well, nouveau does not want to work with 3D, 2D works fine and decoding mp4 works, too but 3D just refuses to run. So I was wondering if I could maybe use this to implement some sort of basic gl driver that can work with lwjgl 2.9 under linux.

In commit 9905df2 a new file (texture_migrate.cc) was added for inclusion in textures.cc and in the makefile but it was never added to the git repo.
Please add it and commit otherwise RSXGL is broken.
Thanks!

Vulnerability Report: Path traversal and Code Execution in dlopen via environment variable

Affected Project & Line:

Summary

Applications using RSXGL may be vulnerable to attacks where a local attacker could execute arbitrary code through a maliciously crafted library, loaded via the dlopen() function. This could potentially lead to privilege escalation.

Details

The application reads unsanitized data from the environment variable. This tainted path is subsequently used directly by dlopen() without sufficient validation, allowing directory traversal and possibly loading external malicious libraries.

The security check currently implemented using [specific security check, e.g., geteuid() == getuid()] does not adequately protect against this vulnerability.

Reproduction Steps

1. Set the affected environment variable to a path containing a maliciously crafted library.
2. Run the application or initiate the specific function that calls dlopen().
3. Observe that the malicious code within the library gets executed.

Impact

Attackers with local access can load and execute arbitrary code in systems using the affected application. This can lead to data corruption, data theft, and potentially complete system compromise depending on the application's privileges.

Recommendation

• Implement thorough input validation for the paths loaded via the environment variables.
• Use a whitelist of allowed paths or directory names to mitigate the risk of arbitrary directory traversal.
• Drop elevated privileges immediately after they are no longer required.
• Regularly audit and review the code to ensure that all paths from which libraries or other external resources are loaded are properly validated.
• Check and compare the real group ID and the effective group ID with getgid() and getegid()

CVSS Score

High 7.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H]

Root Cause Analysis

The root cause of this vulnerability stems from the lack of input validation when reading paths from environment variables and the subsequent insecure use of such paths with the dlopen() function.

Additional References

https://docs.google.com/document/d/1lRE2lc00WAYa-427crBFO1yBzU7fSUmQIanh9W8Rglo/edit?usp=sharing

Hi there, I'm trying to use eglGetProcAddress with RSXGL but I seem to be getting undefined references at linktime even though I have linked in EGL.

[quote]
console/griffin/griffin.o: In function .gfx_ctx_get_proc_address':
griffin.c:(.text.gfx_ctx_get_proc_address+0xc): undefined reference to.eglGetProcAddress'
console/griffin/griffin.o: In function .gl_glsl_init':
griffin.c:(.text.gl_glsl_init+0x5f4): undefined reference to.eglGetProcAddress'
griffin.c:(.text.gl_glsl_init+0x608): undefined reference to .eglGetProcAddress'
griffin.c:(.text.gl_glsl_init+0x61c): undefined reference to.eglGetProcAddress'
griffin.c:(.text.gl_glsl_init+0x630): undefined reference to .eglGetProcAddress'
console/griffin/griffin.o:griffin.c:(.text.gl_glsl_init+0x644): more undefined references to.eglGetProcAddress' follow
collect2: error: ld returned 1 exit status
make: *** [retroarch_psl1ght.elf] Error 1
[/quote]

Any idea if I'm doing something wrong?

I was missing glPixelStorei in a previous version and saw that the most recent version seems to include this, so I git pulled and tried compiling from source but compilation seems to fail somewhere -

I've provided a pastie -

http://pastie.org/4700981

i compiled and installed the program. I tried to run the examples but got errors "undefined reference to 'texcrube_vpo', texcube_vpo_size, texcube_fpo and texcube_fpo_size. Similar errors for rsxglgears. Suggestions?

I noticed nv40asm is segfaulting in one error during compile time. I'm using a modified version of the PS3 toolchain (located at https://github.com/Spork-Schivago/toolchain).

This is the output I see:
[Compiling GLSL vertex program] cube.vert
compiling glsl vertex program "../../../../src/samples/rsxgltest/cube.vert"...../../../../src/samples/rsxgltest/cube.vert(2) : warning C7555: 'attribute' is deprecated, use 'in/out' instead
../../../../src/samples/rsxgltest/cube.vert(3) : warning C7555: 'attribute' is deprecated, use 'in/out' instead
../../../../src/samples/rsxgltest/cube.vert(10) : warning C7555: 'varying' is deprecated, use 'in/out' instead
../../../../src/samples/rsxgltest/cube.vert(24) : warning C7533: global function texture1D is deprecated after version 120
32 lines, 4 warnings, 0 errors.
emit_insn op:0001 slot:0 mask:8
dst: (type:TEMP index:0) srcs: (type:CNST index:10)(swz:0 1 2 3)(type:NONE index:0)(swz:0 1 2 3)(type:NONE index:0)(swz:0 1 2 3)
emit_dst
00001c6c 00400000 00000000 00011ffc
00001c6c 0040000d 81800000 00011ffc
00001c6c 0040000d 8186c080 00011ffc
00001c6c 0040000d 8186c083 60411ffc
emit_insn op:0002 slot:0 mask:8
dst: (type:TEMP index:0) srcs: (type:TEMP index:0)(swz:0 1 2 3)(type:CNST index:9)(swz:0 1 2 3)(type:NONE index:0)(swz:0 1 2 3)
emit_dst
00001c6c 00800000 00000000 00011ffc
00001c6c 0080000d 80800000 00011ffc
00001c6c 0080000d 8086c0c0 00011ffc
00001c6c 0080000d 8086c0c3 60411ffc
emit_insn op:0002 slot:1 mask:8
dst: (type:TEMP index:2) srcs: (type:NONE index:0)(swz:0 1 2 3)(type:NONE index:0)(swz:0 1 2 3)(type:TEMP index:0)(swz:0 0 0 0)
emit_dst
001f9c6c 10000000 00000000 0010017c
001f9c6c 1000000d 81000000 0010017c
001f9c6c 1000000d 8106c080 0010017c
001f9c6c 1000000d 8106c080 0030017c
emit_insn op:0002 slot:0 mask:8
dst: (type:TEMP index:0) srcs: (type:TEMP index:2)(swz:0 1 2 3)(type:CNST index:8)(swz:0 1 2 3)(type:NONE index:0)(swz:0 1 2 3)
emit_dst
00001c6c 00800000 00000000 00011ffc
00001c6c 0080000d 84800000 00011ffc
00001c6c 0080000d 8486c0c0 00011ffc
00001c6c 0080000d 8486c0c3 60411ffc
emit_insn op:0002 slot:0 mask:4
dst: (type:TEMP index:2) srcs: (type:TEMP index:0)(swz:0 0 0 0)(type:CNST index:10)(swz:0 0 0 0)(type:NONE index:0)(swz:0 1 2 3)
emit_dst
00011c6c 00800000 00000000 00009ffc
00011c6c 00800000 00800000 00009ffc
00011c6c 00800000 008000c0 00009ffc
00011c6c 00800000 008000c3 60409ffc
emit_insn op:0003 slot:0 mask:8
dst: (type:TEMP index:0) srcs: (type:TEMP index:2)(swz:1 1 1 1)(type:NONE index:0)(swz:0 1 2 3)(type:TEMP index:2)(swz:0 1 2 3)
emit_dst
00001c6c 00c00000 00000000 00011ffc
00001c6c 00c0002a 84800000 00011ffc
00001c6c 00c0002a 8486c080 00011ffc
00001c6c 00c0002a 8486c083 61211ffc
emit_insn op:0019 slot:0 mask:f
dst: (type:TEMP index:1) srcs: (type:TEMP index:0)(swz:0 1 2 3)../../../src/cgcomp/nv40c: line 160: 10014 Done "${CGC}" ${CGC_opts} "${input}"
10015 Segmentation fault | "${NV40ASM}" ${NV40ASM_opts} > "${output}"
cube.vpo
bin2s: warning: skipping empty file cube.vpo
cube_vpo.o

Any ideas on how to fix it? If you need any more information, just let me know. Thanks.

I noticed when the configure script was checking for the powerpc64 compiler stuff, it was finding ppu-* instead of powerpc64-ps3-elf-*. For example, it found the compiler as ppu-gcc instead of powerpc64-ps3-elf-gcc. I was under the impression the correct way was to have everything use the host triplet format or whatever it's called. Would this be an easy fix? I know it doesn't really prevent the library from compiling or anything. I just think it looks nicer :) Thanks.

i compiled and installed the program. I tried to run the examples but got errors "undefined reference to 'texcrube_vpo', texcube_vpo_size, texcube_fpo and texcube_fpo_size. Similar errors for rsxglgears. Suggestions?

Tried running the example programs (gears, etc) and it seems that rsxInit() locks up my PS3. I'm using 4.31 firmware. Any ideas?

Since July 2020 it's not compilable, but even adjusting compiling issues, eglCreateWindowSurface fail caused by gcmInitBody that keep to NULL _rsx_gcm_context although it returns a value equal to zero.
@gzorin and @kakaroto please spent few time to adjust this library to be usefull. Thanks.