Skip to content

fix(libkernel): reject invalid ftruncate descriptors safely - #5980

Merged
adriadam10 merged 1 commit into
boykopovar:mainfrom
Ondra97:codex/fix-ftruncate-invalid-descriptor
Oct 17, 2026
Merged

adriadam10 merged 1 commit into
boykopovar:mainfrom
Ondra97:codex/fix-ftruncate-invalid-descriptor

Conversation

@Ondra97

@Ondra97 Ondra97 commented Oct 14, 2026

Copy link
Copy Markdown
Contributor

What

On Windows, ftruncate and sceKernelFtruncate with an invalid or closed descriptor reach _chsize_s's invalid-parameter handler. With the default handler this aborts the process instead of returning EBADF.

Reject an invalid native handle before resizing and use the existing thread-local CRT suppression around _chsize_s, preserving the caller's handler. Microsoft documents the invalid-descriptor callback that requires this handling. The regression checks both guest APIs with negative, closed and out-of-range descriptors at zero and nonzero lengths, checks handler restoration, and verifies that the real file is intact. The existing shrinking, extension and permission cases still run.

Tested

I tested on Windows 11 Pro, MinGW-w64 GCC 15.2.0 (WinLibs), Release/Ninja, with BUILD_TESTING=ON, outside the sandbox for the native filesystem cases.

  • On main d9bfa0f3a, the new regression reports 12 CRT parameter-handler invocations and fails.
  • With the fix, guest_truncate, guest_filesystem, guest_aio_bad_descriptors and guest_dup pass (4/4, 0.26 s).
  • After rebasing onto main 8ba869d, full default Windows build, conventions and git diff --check pass.
  • I checked the complete open PR inventory and the 24 shared-file diffs. The 19 AOT diffs are identical in this file and change macOS paths; the remaining changes cover positioned transfers, append writes, archive-backed descriptors and standard-stream closure. feat: read title files from a read-only app0.zar (ZArchive) layer #5835's archive check in the public ftruncate wrapper does not implement this Windows native-handle fix. The focused repository overlap check is clean.

Linux/macOS and a retail title were not run; production changes are inside the existing Windows branch.

Checklist

  • Based on current main; no other open PR implements the same functions
  • One topic per PR; follow-ups go in a new PR
  • No comments in code except technical debt
  • Unimplemented paths throw (NotImplemented_nid_no_patch); silent stubs are listed in technical debt
  • No notes, investigation .md files or images added to the repository
  • New third-party code is a submodule built from source
  • Generic behaviour, not specific to one title
  • Depends on: none
  • Unblocks: none
  • GPUs tested: n/a
  • AI-assisted: yes — Codex

@github-actions

github-actions Bot commented Oct 15, 2026 •

Copy link
Copy Markdown

Other open pull requests touch the same code. Merging one will break the other, or both implement the same thing. If this one builds on them, list them in Depends on.

Pull request Conflicting files (lines on main) Same exports Same new files
PR 6287 core/libs/prx/libkernel/File/src/Stdio.cpp L118-119

Some comparisons could not be completed because a pull request conflicts with the base branch. Review these shared files manually before concluding that there is no overlap.

Pull request Shared files not compared
PR 5021 core/libs/prx/libkernel/File/src/Stdio.cpp
PR 6044 core/libs/tests/GuestTruncate.cpp
PR 6222 core/libs/prx/libkernel/File/src/Stdio.cpp
PR 6879 core/libs/prx/libkernel/File/src/Stdio.cpp

This was referenced Oct 15, 2026
@adriadam10 adriadam10 self-assigned this Oct 16, 2026
@adriadam10

Copy link
Copy Markdown
Collaborator

Checked the diff against the existing WithoutParameterHandler usage in Stdio.cpp and the new GuestTruncate regression (negative, closed and out-of-range descriptors, both guest APIs, handler restored). Build and ctest are green on Linux; the Windows path is covered by the Windows build run before merge. Merging.

@adriadam10

Copy link
Copy Markdown
Collaborator

Re-checked against current main: the diff still applies cleanly and NativeFtruncate is unchanged by the recent Stdio.cpp merges. Build and ctest are green on Linux (guest_truncate included); the Windows path is covered by the Windows build run before merge. Merging.

@adriadam10
adriadam10 merged commit 37f0253 into boykopovar:main Oct 17, 2026
9 checks passed
@Ondra97
Ondra97 deleted the codex/fix-ftruncate-invalid-descriptor branch October 17, 2026 14:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants