From eaba867f28752e55ad2d1b2b29f456f7a9dc39fb Mon Sep 17 00:00:00 2001 From: "Unknown W. Brackets" Date: Sun, 23 Jun 2019 11:25:27 -0700 Subject: [PATCH] SaveState: Fail load on decompression error. Simply checking the size isn't enough, because it doesn't write the decompressed size in the case of invalid data. May help the crash in #11890. --- Common/ChunkFile.cpp | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/Common/ChunkFile.cpp b/Common/ChunkFile.cpp index 4e2334e735..22327a7575 100644 --- a/Common/ChunkFile.cpp +++ b/Common/ChunkFile.cpp @@ -249,19 +249,27 @@ CChunkFileReader::Error CChunkFileReader::LoadFile(const std::string &filename, return ERROR_BAD_FILE; } - _buffer = buffer; if (header.Compress) { u8 *uncomp_buffer = new u8[header.UncompressedSize]; size_t uncomp_size = header.UncompressedSize; - snappy_uncompress((const char *)buffer, sz, (char *)uncomp_buffer, &uncomp_size); + auto status = snappy_uncompress((const char *)buffer, sz, (char *)uncomp_buffer, &uncomp_size); + if (status != SNAPPY_OK) { + ERROR_LOG(SAVESTATE, "ChunkReader: Failed to decompress file"); + delete [] uncomp_buffer; + delete [] buffer; + return ERROR_BAD_FILE; + } if ((u32)uncomp_size != header.UncompressedSize) { ERROR_LOG(SAVESTATE, "Size mismatch: file: %u calc: %u", header.UncompressedSize, (u32)uncomp_size); delete [] uncomp_buffer; + delete [] buffer; return ERROR_BAD_FILE; } _buffer = uncomp_buffer; sz = uncomp_size; delete [] buffer; + } else { + _buffer = buffer; } if (header.GitVersion[31]) {