From c45ceb6e2f6134653ededa8ea54b944b05ebf55b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Henrik=20Rydg=C3=A5rd?= Date: Sun, 9 Aug 2026 15:52:28 +0200 Subject: [PATCH] ShiftJIS: don't consume the null terminator as a second byte next() would read a truncated lead byte's "second byte" unconditionally, even when that byte was actually the string's null terminator - leaving index_ one past the terminator, so a subsequent end()/next() call read one byte out of bounds. Now checks for the terminator before consuming it, returning INVALID without advancing past it. Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_01L4QAoxV2KY7ek4PcZw3WvY --- Common/Data/Encoding/Shiftjis.h | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/Common/Data/Encoding/Shiftjis.h b/Common/Data/Encoding/Shiftjis.h index bcda427d1c..35ffb8e752 100644 --- a/Common/Data/Encoding/Shiftjis.h +++ b/Common/Data/Encoding/Shiftjis.h @@ -43,6 +43,11 @@ struct ShiftJIS { } // Okay, if we didn't return, it's time for the second byte (the cell.) + if (c_[index_] == 0) { + // Truncated sequence right at the end of the string - don't consume the + // terminator, or index_ would end up one past it (OOB on the next call). + return INVALID; + } j = (uint8_t)c_[index_++]; // Not a valid second byte. if (j < 0x40 || j == 0x7F || j >= 0xFD) {