From 983068b07a4257ed99b1f79cb3e9cecc6320a73c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Henrik=20Rydg=C3=A5rd?= Date: Sat, 1 Aug 2026 11:03:11 +0200 Subject: [PATCH] Fix OOB read on unterminated module names in PRX import debug reporter The import debug reporter used IsValidAddress (start-address only) before formatting module names with %s, so a crafted unterminated name could be read past guest RAM. Use IsValidNullTerminatedString instead. --- Core/HLE/sceKernelModule.cpp | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/Core/HLE/sceKernelModule.cpp b/Core/HLE/sceKernelModule.cpp index 5f43e9d273..714b3c4831 100644 --- a/Core/HLE/sceKernelModule.cpp +++ b/Core/HLE/sceKernelModule.cpp @@ -835,8 +835,8 @@ static bool KernelImportModuleFuncs(PSPModule *module, u32 *firstImportStubAddr, entryPos += entry->size; const char *modulename; - if (Memory::IsValidAddress(entry->name)) { - modulename = Memory::GetCharPointer(entry->name); + if (Memory::IsValidNullTerminatedString(entry->name)) { + modulename = Memory::GetCharPointerUnchecked(entry->name); } else { modulename = "(invalidname)"; needReport = true; @@ -932,7 +932,9 @@ static bool KernelImportModuleFuncs(PSPModule *module, u32 *firstImportStubAddr, char temp[512]; const char *modulename; - if (Memory::IsValidAddress(entry->name)) { + // Check for NUL termination within the mapped region so %s below + // can't read past guest RAM on a crafted, unterminated name. + if (Memory::IsValidNullTerminatedString(entry->name)) { modulename = Memory::GetCharPointerUnchecked(entry->name); } else { modulename = "(invalidname)";