mirror of
https://github.com/dolphin-emu/dolphin.git
synced 2026-10-20 17:48:59 +02:00
The save sync parser preserved an oversized banner length after limiting the copy into the fixed header buffer. The NAND writer then used the untrusted length and read beyond the stack object. Reject invalid or oversized lengths before copying the banner.