From 0bcf7c8e2bf60ed42dcd107551d3f05f118c557d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Henrik=20Rydg=C3=A5rd?= <hrydgard@gmail.com>
Date: Fri, 9 Oct 2026 14:21:39 +0200
Subject: [PATCH] Ctrl: Validate the sample buffer indices from savestates

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 Core/HLE/sceCtrl.cpp | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/Core/HLE/sceCtrl.cpp b/Core/HLE/sceCtrl.cpp
index fd098ccb52..559349961d 100644
--- a/Core/HLE/sceCtrl.cpp
+++ b/Core/HLE/sceCtrl.cpp
@@ -456,6 +456,13 @@ void __CtrlDoState(PointerWrap &p)
 	}
 	Do(p, ctrlBuf);
 	Do(p, ctrlBufRead);
+	if (ctrlBuf >= NUM_CTRL_BUFFERS || ctrlBufRead >= NUM_CTRL_BUFFERS) {
+		ERROR_LOG(Log::sceCtrl, "Savestate failure: invalid ctrl buffer index");
+		p.SetError(p.ERROR_FAILURE);
+		ctrlBuf = 0;
+		ctrlBufRead = 0;
+		return;
+	}
 	Do(p, latch);
 	if (s == 1) {
 		dialogBtnMake = 0;