diff --git a/Core/HLE/sceKernelModule.cpp b/Core/HLE/sceKernelModule.cpp index 714b3c4831..4ef998c915 100644 --- a/Core/HLE/sceKernelModule.cpp +++ b/Core/HLE/sceKernelModule.cpp @@ -358,7 +358,9 @@ void PSPModule::GetLongInfo(char *ptr, int bufSize) const { StringWriter w(ptr, bufSize); w.F("%s: Version %d.%d. %d segments", nm.name, nm.version[1], nm.version[0], nm.nsegment).endl(); w.F("Memory block: %08x (%08x/%d bytes)", memoryBlockAddr, memoryBlockSize, memoryBlockSize).endl(); - for (int i = 0; i < (int)nm.nsegment; i++) { + // nm.nsegment is attacker-controlled (up to u32 max) but segmentaddr/ + // segmentsize are fixed 4-entry arrays; clamp like the other consumers. + for (int i = 0; i < (int)nm.nsegment && i < 4; i++) { w.F(" %08x (%08x bytes)\n", nm.segmentaddr[i], nm.segmentsize[i]); } w.F("Text: %08x (%08x bytes)\n", nm.text_addr, nm.text_size);