From a3bf3c7153c4f20aada7987101a9d4df763eb0cb Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Henrik=20Rydg=C3=A5rd?= Date: Tue, 11 Aug 2026 15:43:48 +0200 Subject: [PATCH] Cut down on Claude's excesses --- Core/Debugger/WebSocket/GPUBufferSubscriber.cpp | 9 ++++----- Core/Replay.cpp | 4 +--- 2 files changed, 5 insertions(+), 8 deletions(-) diff --git a/Core/Debugger/WebSocket/GPUBufferSubscriber.cpp b/Core/Debugger/WebSocket/GPUBufferSubscriber.cpp index d7e8e92def..649cd9650e 100644 --- a/Core/Debugger/WebSocket/GPUBufferSubscriber.cpp +++ b/Core/Debugger/WebSocket/GPUBufferSubscriber.cpp @@ -388,12 +388,11 @@ void WebSocketGPUBufferTexture(DebuggerRequest &req) { u32 level = 0; if (!req.ParamU32("level", &level, false, DebuggerParamType::OPTIONAL)) return; - // GPU_GetCurrentTexture() takes a plain int; a client-supplied value whose - // u32->int conversion is negative would skip backends' "level >= mip count" - // bounds check (which only fires for level > 0), reaching backend texture-copy - // code with a bogus mip index. - if (level > 0x7FFFFFFF) + // Sanity check the level, to avoid overflow hacks. Also it just can't be very high, + // we currently support 12 levels for replacement (the PSP only supports 8). + if (level > 12) { return req.Fail("Invalid level"); + } GenericStreamBuffer(req, [level](const GPUDebugBuffer *&buf, bool *isFramebuffer) { return GPUStepping::GPU_GetCurrentTexture(buf, level, isFramebuffer); diff --git a/Core/Replay.cpp b/Core/Replay.cpp index 0a500d5343..7a32ca207a 100644 --- a/Core/Replay.cpp +++ b/Core/Replay.cpp @@ -154,9 +154,7 @@ bool ReplayExecuteBlob(int version, const std::vector &data) { if ((int)item.info.action & (int)ReplayAction::MASK_SIDEDATA) { // Subtraction-based check (rather than i + item.info.size > sz) avoids - // wraparound on platforms where size_t is 32-bit, where a large enough - // item.info.size could otherwise make the addition overflow and wrap - // below sz, defeating this bounds check before the memcpy below. + // wraparound on platforms where size_t is 32-bit. Bound checking because memcpy. if (item.info.size > sz - i) { ERROR_LOG(Log::System, "Truncated replay data at %lld during side data", (long long)i); break;