From 2a54eff606e306e91c33320462eeb7782aac3082 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Henrik=20Rydg=C3=A5rd?= Date: Fri, 9 Oct 2026 14:11:40 +0200 Subject: [PATCH] AdhocMatching: Don't write past the GetMembers buffer The sibling/child loop didn't check requestedpeers, so a game passing a buffer smaller than the member count got it overflowed. Also validate the guest range before writing. Co-Authored-By: Claude Opus 5.5 (1M context) --- Core/HLE/sceNetAdhocMatching.cpp | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/Core/HLE/sceNetAdhocMatching.cpp b/Core/HLE/sceNetAdhocMatching.cpp index 24bb81d7fa..854146192c 100644 --- a/Core/HLE/sceNetAdhocMatching.cpp +++ b/Core/HLE/sceNetAdhocMatching.cpp @@ -2329,6 +2329,10 @@ static int sceNetAdhocMatchingGetMembers(int matchingId, u32 sizeAddr, u32 buf) // Fix Oversize Request if ((*buflen) > available) *buflen = available; + if (!Memory::IsValidRange(buf, *buflen)) { + return hleLogError(Log::sceNet, SCE_NET_ADHOC_MATCHING_ERROR_INVALID_ARG, "adhocmatching invalid arg"); + } + // Clear Memory memset(buf2, 0, *buflen); @@ -2410,6 +2414,10 @@ static int sceNetAdhocMatchingGetMembers(int matchingId, u32 sizeAddr, u32 buf) // Iterate rearranged peers for (const auto& peer : sortedPeers) { + if (filledpeers >= requestedpeers) { + break; + } + // Parent Mode if (context->mode == PSP_ADHOC_MATCHING_MODE_PARENT) { // Interested in Children