Skip to content

cdvdman: use real media size for out-of-bounds checks - #1763

Open
oMrRexD wants to merge 1 commit into
ps2homebrew:masterfrom
oMrRexD:fix/oob-media-lsn-count
Open

cdvdman: use real media size for out-of-bounds checks#1763
oMrRexD wants to merge 1 commit into
ps2homebrew:masterfrom
oMrRexD:fix/oob-media-lsn-count

Conversation

@oMrRexD

@oMrRexD oMrRexD commented Aug 6, 2026

Copy link
Copy Markdown

Pull Request checklist

Note: these are not necessarily requirements

  • I reformatted the code with clang-format
  • I checked to make sure my submission worked
  • I am the author of submission or have permission from the original author
  • Requires update of the PS2SDK or other dependencies
  • Others (please specify below)

Pull Request description

Fixes #1737.

Problem

#961 added out-of-bounds read/seek emulation, taking the media size (mediaLsnCount) from the ISO9660 PVD "Volume Space Size" field. That field describes the ISO9660 volume, not the disc. Some discs were mastered with it understating the real size, keeping the bulk of the game data past the end of the declared volume and reading it by raw LBA.

On those discs every read of the game data now fails with SCECdErIPI, so they stopped booting from Beta-2009 onwards. Two redump-verified dumps with the defect:

Disc PVD volume size Real sectors Real data past the volume
Zombie Zone (Europe) [SLES_533.98] 205,367 314,959 ~220 MB, starting at LBA 205,367
Demolition Girl (Europe) [SLES_534.03] 172,567 315,201 ~270 MB, starting at LBA 172,567

On real hardware these reads succeed: the drive only rejects reads past the physical end of the disc, and those sectors physically exist. Discs of the same engine family whose PVD is correct (e.g. [SLES_544.61], [SLPM_625.25], [SLPM_626.38]) were never affected, so this is a per-disc mastering problem rather than a per-game one.

Change

The emulation from #961 is kept; only the source of the sector count changes to the real media size, which the EE side already knows at launch time:

  • struct cdvdman_settings_common gains a mediaLsnCount field.
  • BDM/SMB: sum of the image part sizes, via the new sbGetMediaLsnCount(); for ZSO images the uncompressed sector count from the ZISO header is used instead.
  • HDD: the HDL header's total_size_in_kb (ziso_total_block for ZSO).
  • cdvdman_searchfile_init() prefers that value and falls back to the PVD when it is zero, so any path that does not set it keeps the current behaviour.

Games that read past the physical end of the image — the ones #421 was about, e.g. Ratchet & Clank 3 PAL — still get their error, since the check itself is unchanged.

Testing

Builds cleanly with make clean release in the official ghcr.io/ps2homebrew/ps2homebrew:main image, and passes clang-format 12.

Tested on a SCPH-50001/N with the games on USB:

  • Zombie Zone [SLES_533.98] and Demolition Girl [SLES_534.03] boot and play again from unmodified images, matching their behaviour on Beta-2004 and older.
  • Hot Wheels: Beat That! — one of the titles the out-of-bounds emulation was added for in [ISSUE] Out of Bounds disc access not emulated properly. #421 — still works, so the emulation itself is intact.
  • Dual-layer DVD9 still works, tested with a full 8.5 GB title.
  • [SLES_544.61], [SLPM_625.25] and [SLPM_626.38] (same engine family, correct PVDs) keep working.

Independent confirmation of the root cause: hex-patching only the PVD Volume Space Size of an affected image to the real sector count also makes it boot on a stock Beta-2245 build.

Not exercised on my side: the SMB and ZSO paths, and Ratchet & Clank 3 — its #421 case triggers in the vid-comic 5 level, and the savedata linked from #389 for reaching it is no longer downloadable.

The out-of-bounds read/seek emulation took mediaLsnCount from the ISO9660
PVD "Volume Space Size" field, which describes the ISO9660 volume and not
the disc. Discs mastered with that field understated keep data past the
end of the volume and read it by raw LBA, which works on real hardware but
now fails with SCECdErIPI.

Pass the real media sector count from the EE side instead, and fall back to
the PVD value when it is not provided.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[ISSUE]: Zombie Zone [SLES_533.98] broken since Beta-2009 — OOB read check trusts the ISO9660 PVD volume size, which understates the real disc size

1 participant