Mirror/atmosphere
1
0
Fork 0
mirror of https://github.com/Atmosphere-NX/Atmosphere.git synced 2026-07-21 18:52:08 +00:00
Code Issues Packages Projects Releases Wiki Activity

sf: close request copy handles in mitm ForwardRequest

Browse Source 
ForwardRequest closes copy handles from the forward response but never from the request. Any mitm'd command that carries a client copy handle therefore leaks that handle in the mitm process for its lifetime. A leaked transfer memory pins the client process object after it dies, its application memory reservation never releases, and the next application launch blocks forever freezing the console.

Close the request's copy handles after the forward send, parsed from the saved message.
This commit is contained in:
dogty 2026-07-14 13:35:56 +02:00
parent 3ace80cc7b
commit b05166d502
1 changed files with 10 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
libraries/libstratosphere/source/sf/hipc/sf_hipc_server_session_manager.cpp
View File

@ -60,7 +60,16 @@ namespace ams::sf::hipc {
PreProcessCommandBufferForMitm(ctx, m_pointer_buffer, reinterpret_cast<uintptr_t>(message_buffer));
/* Dispatch forwards. */
R_TRY(svc::SendSyncRequest(util::GetReference(m_forward_service)->session));
{
ON_SCOPE_EXIT {
const auto saved_request = hipcParseRequest(const_cast<void *>(m_saved_message.GetPointer()));
for (u32 i = 0; i < saved_request.meta.num_copy_handles; i++) {
os::CloseNativeHandle(saved_request.data.copy_handles[i]);
}
};
R_TRY(svc::SendSyncRequest(util::GetReference(m_forward_service)->session));
}
/* Parse, to ensure we catch any copy handles and close them. */
{