From c5ef99ad3f9d983ce4592dcaafcdd6613f294f08 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Henrik=20Rydg=C3=A5rd?= Date: Wed, 30 Sep 2026 11:12:53 -0600 Subject: [PATCH] IconCache: Check entry lengths before allocating when loading the cache The key was resized before its length was checked, and the data length wasn't checked at all, so a corrupt icon.cache could make a multi-GB allocation and crash every launch. The cache is only saved at a clean exit, so a bad file stayed. Co-Authored-By: Claude Opus 5.5 (1M context) --- Common/UI/IconCache.cpp | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/Common/UI/IconCache.cpp b/Common/UI/IconCache.cpp index d071e79334..bd098c707a 100644 --- a/Common/UI/IconCache.cpp +++ b/Common/UI/IconCache.cpp @@ -79,13 +79,14 @@ bool IconCache::LoadFromFile(FILE *file) { break; } - std::string key; - key.resize(entryHeader.keyLen, 0); - if (entryHeader.keyLen > 0x1000) { - // Let's say this is invalid, probably a corrupted file. + if (entryHeader.keyLen > 0x1000 || entryHeader.dataLen > MAX_SAVED_CACHE_SIZE) { + // Let's say this is invalid, probably a corrupted file. Check before allocating. break; } + std::string key; + key.resize(entryHeader.keyLen, 0); + if (fread(&key[0], 1, entryHeader.keyLen, file) != entryHeader.keyLen) { break; }