From 06522e91a0beb6ffde8d797f8aef7d20969a6407 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Henrik=20Rydg=C3=A5rd?= <hrydgard@gmail.com>
Date: Tue, 11 Aug 2026 15:05:05 +0200
Subject: [PATCH] BreakpointSubscriber: apply the same overflow check to
 breakpoint removal

WebSocketMemoryBreakpointParams::Parse() (used by add/update) checks
for address + size wrapping around before computing the end address,
but memory.breakpoint.remove computed it inline without that check.
Apply the same check for consistency - a crafted size could otherwise
wrap the computed end below address, causing RemoveMemCheck to operate
on an unintended range.
---
 Core/Debugger/WebSocket/BreakpointSubscriber.cpp | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/Core/Debugger/WebSocket/BreakpointSubscriber.cpp b/Core/Debugger/WebSocket/BreakpointSubscriber.cpp
index 9f76c2306b..928addd1c3 100644
--- a/Core/Debugger/WebSocket/BreakpointSubscriber.cpp
+++ b/Core/Debugger/WebSocket/BreakpointSubscriber.cpp
@@ -446,6 +446,10 @@ void WebSocketMemoryBreakpointRemove(DebuggerRequest &req) {
 	uint32_t size;
 	if (!req.ParamU32("size", &size))
 		return;
+	// Matches the check in WebSocketMemoryBreakpointParams::Parse() (used by add/update) -
+	// without it, a crafted size could wrap address + size below address.
+	if (address + size < address)
+		return req.Fail("Size is too large");
 
 	// Route the actual breakpoint manipulation to the CPU thread instead of poking at it directly
 	// from this WebSocket handler thread - see Core_RunOnCPUThread() in Core.h.