From 77fed5825708afd5740fd321002de28ab25c44ea Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Henrik=20Rydg=C3=A5rd?= Date: Sun, 8 Nov 2026 13:54:41 +0100 Subject: [PATCH] sceNetAdhocMatching: Don't copy from a missing SendData or SelectTarget buffer Since 74178a8106 a data or opt buffer that runs past the end of memory is passed on as NULL, and SendData and SelectTarget then copied dataLen or optLen bytes from it, crashing the emulator. Return INVALID_ARG, as CancelTargetWithOpt already does. Co-Authored-By: Claude Opus 5.5 --- Core/HLE/sceNetAdhocMatching.cpp | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/Core/HLE/sceNetAdhocMatching.cpp b/Core/HLE/sceNetAdhocMatching.cpp index d73459d1a9..94cc80c454 100644 --- a/Core/HLE/sceNetAdhocMatching.cpp +++ b/Core/HLE/sceNetAdhocMatching.cpp @@ -1854,6 +1854,10 @@ static int sceNetAdhocMatchingSelectTarget(MIPSState *mips, int matchingId, cons void * opt = NULL; if (Memory::IsValidRange(optDataPtr, std::max(optLen, 1))) opt = Memory::GetPointerWriteUnchecked(optDataPtr); + // The messages copy optLen bytes from it. + if (optLen > 0 && opt == NULL) { + return hleLogError(Log::sceNet, SCE_NET_ADHOC_MATCHING_ERROR_INVALID_ARG, "adhocmatching bad opt buffer"); + } // Host Mode if (context->mode == PSP_ADHOC_MATCHING_MODE_PARENT) { // Already Connected. Right after accepting, it's still in progress (pspautotests net/adhoc/pair/matching). @@ -2389,6 +2393,10 @@ int sceNetAdhocMatchingSendData(MIPSState *mips, int matchingId, const char *mac void* data = NULL; if (Memory::IsValidRange(dataAddr, dataLen)) data = Memory::GetPointerWriteUnchecked(dataAddr); + // The bulk packet copies all dataLen bytes from it. + if (data == NULL) { + return hleLogError(Log::sceNet, SCE_NET_ADHOC_MATCHING_ERROR_INVALID_ARG, "bad data buffer"); + } // Lock the peer std::lock_guard peer_guard(peerlock);