mirror of
https://github.com/RetroPortingToolKit/psxrecomp
synced 2026-10-26 02:11:36 -04:00
Matthew Stanley
e02b7b3455
Audit fixes for the async shard-publication pipeline (45a2dda):
- autocompile_shutdown(): stops the pipeline, kills the compiler tree via a
kill-on-close job object (assigned while the child is SUSPENDED so cmd.exe
cannot spawn grandchildren outside it), and JOINS the watcher + preparer —
never abandoning a thread inside the Windows loader lock at ExitProcess.
Wired first into shutdown_runtime(). Crash exits reap the tree via the job.
- Failed off-thread prepares retry (3 attempts, 100 ms) on the worker before
the artifact silently reverts to a synchronous emu-thread first-map; retry
and giveup counters exposed in autocompile_status_json.
- Capacity caps fail closed and LOUD: cand_register shouts once at CAND_CAP;
load_one_dll_prepared refuses at MAX_LOADED_DLLS before registering, so
dll_already_loaded can never lose track and double-register on rescan.
- Publication confinement is filesystem-resolved: published_path_valid
canonicalizes the cache root and the pipe path (GetFinalPathNameByHandle /
realpath), prefix-checks canonical forms, and the worker maps the canonical
string while holding a no-delete-share guard handle (TOCTOU). `..`/junction
spellings that passed the lexical check are now rejected — proven by the
new overlay_path_canon_test boundary test.
- test_autocompile_publication gains a shutdown-mid-run scenario asserting
prepared == committed + discarded with nothing queued; perf guards updated
to require validate -> guard-handle -> canonical first-map ordering.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
40 lines
1.4 KiB
C
40 lines
1.4 KiB
C
/* overlay_path_canon.h — filesystem-resolved path canonicalization for the
|
|
* overlay cache's confinement boundary. A lexical prefix check can never be
|
|
* made correct against `..` segments or reparse points (symlinks/junctions):
|
|
* the only sound comparison resolves BOTH sides through the filesystem, the
|
|
* same way LoadLibrary/dlopen will resolve them, and prefix-checks the
|
|
* results. All functions fail CLOSED (0) on any resolution error. */
|
|
#ifndef PSXRECOMP_OVERLAY_PATH_CANON_H
|
|
#define PSXRECOMP_OVERLAY_PATH_CANON_H
|
|
|
|
#include <stddef.h>
|
|
|
|
#ifdef _WIN32
|
|
#define WIN32_LEAN_AND_MEAN
|
|
#include <windows.h>
|
|
#endif
|
|
|
|
#ifdef __cplusplus
|
|
extern "C" {
|
|
#endif
|
|
|
|
/* Resolve `path` (file or directory; must exist) to its final normalized
|
|
* form — `..`, short names, and every reparse point resolved. Returns 1 and
|
|
* NUL-terminates `out` on success; 0 on any failure (missing, inaccessible,
|
|
* result longer than cap). */
|
|
int overlay_path_canonicalize(const char *path, char *out, size_t cap);
|
|
|
|
#ifdef _WIN32
|
|
/* Same resolution from an already-open handle. Lets a caller open the file
|
|
* with restrictive sharing FIRST and validate the canonical identity of the
|
|
* object it actually holds — closing the validate-then-swap (TOCTOU) window
|
|
* before LoadLibrary. */
|
|
int overlay_path_canonicalize_handle(HANDLE h, char *out, size_t cap);
|
|
#endif
|
|
|
|
#ifdef __cplusplus
|
|
}
|
|
#endif
|
|
|
|
#endif /* PSXRECOMP_OVERLAY_PATH_CANON_H */
|