4 files changed, 27 insertions, 13 deletions

diff --git a/src/core/hle/kernel/process.cpp b/src/core/hle/kernel/process.cpp
index f06b6bb55..a257c3726 100644
--- a/src/core/hle/kernel/process.cpp
+++ b/src/core/hle/kernel/process.cpp
@@ -252,8 +252,8 @@ ResultCode Process::HeapFree(VAddr target, u32 size) {
     return vm_manager.HeapFree(target, size);
 }
 
-ResultCode Process::MirrorMemory(VAddr dst_addr, VAddr src_addr, u64 size) {
-    return vm_manager.MirrorMemory(dst_addr, src_addr, size);
+ResultCode Process::MirrorMemory(VAddr dst_addr, VAddr src_addr, u64 size, MemoryState state) {
+    return vm_manager.MirrorMemory(dst_addr, src_addr, size, state);
 }
 
 ResultCode Process::UnmapMemory(VAddr dst_addr, VAddr /*src_addr*/, u64 size) {
diff --git a/src/core/hle/kernel/vm_manager.cpp b/src/core/hle/kernel/vm_manager.cpp
index ec7fd6150..100f8f6bf 100644
--- a/src/core/hle/kernel/vm_manager.cpp
+++ b/src/core/hle/kernel/vm_manager.cpp
@@ -298,7 +298,7 @@ ResultCode VMManager::HeapFree(VAddr target, u64 size) {
     return RESULT_SUCCESS;
 }
 
-ResultCode VMManager::MirrorMemory(VAddr dst_addr, VAddr src_addr, u64 size) {
+ResultCode VMManager::MirrorMemory(VAddr dst_addr, VAddr src_addr, u64 size, MemoryState state) {
     const auto vma = FindVMA(src_addr);
 
     ASSERT_MSG(vma != vma_map.end(), "Invalid memory address");
@@ -312,8 +312,8 @@ ResultCode VMManager::MirrorMemory(VAddr dst_addr, VAddr src_addr, u64 size) {
     const std::shared_ptr<std::vector<u8>>& backing_block = vma->second.backing_block;
     const std::size_t backing_block_offset = vma->second.offset + vma_offset;
 
-    CASCADE_RESULT(auto new_vma, MapMemoryBlock(dst_addr, backing_block, backing_block_offset, size,
-                                                MemoryState::Mapped));
+    CASCADE_RESULT(auto new_vma,
+                   MapMemoryBlock(dst_addr, backing_block, backing_block_offset, size, state));
     // Protect mirror with permissions from old region
     Reprotect(new_vma, vma->second.permissions);
     // Remove permissions from old region
diff --git a/src/core/hle/kernel/vm_manager.h b/src/core/hle/kernel/vm_manager.h
index 248cc46dc..d522404fe 100644
--- a/src/core/hle/kernel/vm_manager.h
+++ b/src/core/hle/kernel/vm_manager.h
@@ -189,7 +189,8 @@ public:
     ResultVal<VAddr> HeapAllocate(VAddr target, u64 size, VMAPermission perms);
     ResultCode HeapFree(VAddr target, u64 size);
 
-    ResultCode MirrorMemory(VAddr dst_addr, VAddr src_addr, u64 size);
+    ResultCode MirrorMemory(VAddr dst_addr, VAddr src_addr, u64 size,
+                            MemoryState state = MemoryState::Mapped);
 
     /**
      * Scans all VMAs and updates the page table range of any that use the given vector as backing
diff --git a/src/core/hle/service/ldr/ldr.cpp b/src/core/hle/service/ldr/ldr.cpp
index 5f020cbe0..b43f1f054 100644
--- a/src/core/hle/service/ldr/ldr.cpp
+++ b/src/core/hle/service/ldr/ldr.cpp
@@ -18,6 +18,7 @@ namespace Service::LDR {
 
 namespace ErrCodes {
 enum {
+    InvalidMemoryState = 51,
     InvalidNRO = 52,
     InvalidNRR = 53,
     MissingNRRHash = 54,
@@ -32,6 +33,7 @@ enum {
 };
 }
 
+constexpr ResultCode ERROR_INVALID_MEMORY_STATE(ErrorModule::Loader, ErrCodes::InvalidMemoryState);
 constexpr ResultCode ERROR_INVALID_NRO(ErrorModule::Loader, ErrCodes::InvalidNRO);
 constexpr ResultCode ERROR_INVALID_NRR(ErrorModule::Loader, ErrCodes::InvalidNRR);
 constexpr ResultCode ERROR_MISSING_NRR_HASH(ErrorModule::Loader, ErrCodes::MissingNRRHash);
@@ -120,7 +122,7 @@ public:
             return;
         }
 
-        if (nro.size() >= MAXIMUM_LOADED_RO) {
+        if (nrr.size() >= MAXIMUM_LOADED_RO) {
             LOG_ERROR(Service_LDR, "Loading new NRR would exceed the maximum number of loaded NRRs "
                                    "(0x40)! Failing...");
             IPC::ResponseBuilder rb{ctx, 2};
@@ -178,10 +180,13 @@ public:
         }
 
         std::vector<SHA256Hash> hashes;
+
+        // Copy all hashes in the NRR (specified by hash count/hash offset) into vector.
         for (std::size_t i = header.hash_offset;
-             i < (header.hash_offset + (header.hash_count << 5)); i += 8) {
-            hashes.emplace_back();
-            std::memcpy(hashes.back().data(), nrr_data.data() + i, sizeof(SHA256Hash));
+             i < (header.hash_offset + (header.hash_count * sizeof(SHA256Hash))); i += 8) {
+            SHA256Hash hash;
+            std::memcpy(hash.data(), nrr_data.data() + i, sizeof(SHA256Hash));
+            hashes.emplace_back(hash);
         }
 
         nrr.insert_or_assign(nrr_addr, std::move(hashes));
@@ -258,8 +263,8 @@ public:
         // NRO Size or BSS Size is zero or causes overflow
         const auto nro_size_valid =
             nro_size != 0 && nro_addr + nro_size > nro_addr && Common::Is4KBAligned(nro_size);
-        const auto bss_size_valid = std::numeric_limits<u64>::max() - nro_size >= bss_size &&
-                                    (bss_size == 0 || bss_addr + bss_size > bss_addr);
+        const auto bss_size_valid =
+            nro_size + bss_size >= nro_size && (bss_size == 0 || bss_addr + bss_size > bss_addr);
 
         if (!nro_size_valid || !bss_size_valid) {
             LOG_ERROR(Service_LDR,
@@ -313,7 +318,15 @@ public:
         auto& vm_manager = process->VMManager();
         auto map_address = vm_manager.FindFreeRegion(nro_size + bss_size);
 
-        ASSERT(map_address.Succeeded());
+        if (!map_address.Succeeded() ||
+            *map_address + nro_size + bss_size > vm_manager.GetAddressSpaceEndAddress()) {
+
+            LOG_ERROR(Service_LDR,
+                      "General error while allocation memory or no available memory to allocate!");
+            IPC::ResponseBuilder rb{ctx, 2};
+            rb.Push(ERROR_INVALID_MEMORY_STATE);
+            return;
+        }
 
         ASSERT(process->MirrorMemory(*map_address, nro_addr, nro_size,
                                      Kernel::MemoryState::ModuleCodeStatic) == RESULT_SUCCESS);