From a8195e7ca6332ebba0d28d0c0a6b8fcff53000ed Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Henrik=20Rydg=C3=A5rd?= Date: Sat, 1 Aug 2026 11:09:09 +0200 Subject: [PATCH] Clamp HTTP response body to the requested range in HTTPFileLoader A malicious or MITM'd server could send a Content-Range header matching the requested range but a larger entity body, overflowing the caller's fixed-size buffer via output.Take. Clamp the copied size to the requested range. --- Core/FileLoaders/HTTPFileLoader.cpp | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/Core/FileLoaders/HTTPFileLoader.cpp b/Core/FileLoaders/HTTPFileLoader.cpp index 6e4489bb8c..8830994ee6 100644 --- a/Core/FileLoaders/HTTPFileLoader.cpp +++ b/Core/FileLoaders/HTTPFileLoader.cpp @@ -254,7 +254,10 @@ size_t HTTPFileLoader::ReadAt(s64 absolutePos, size_t bytes, void *data, Flags f return 0; } - size_t readBytes = output.size(); + // Never trust the entity length: a malicious/MITM'd server can claim a + // matching Content-Range but send a larger body. Clamp to what we + // requested so we can't overflow the caller's fixed-size buffer. + size_t readBytes = std::min(output.size(), (size_t)(absoluteEnd - absolutePos)); output.Take(readBytes, (char *)data); filepos_ = absolutePos + readBytes; return readBytes;