pngLoadPtr allocated the decoded buffer directly from attacker-controlled
PNG IHDR dimensions with no upper bound, so browsing a crafted game icon
or savedata could trigger a multi-gigabyte allocation.
- Add maxWidth/maxHeight parameters to pngLoadPtr (default 8192x8192)
and reject images larger than the limits.
- Thread the limits through LoadTextureLevelsFromFileData,
CreateTextureFromFileData, and CreateTextureFromFile.
- Limit game icons to 256x128 in GameInfoCache and IconCache.
FixedSizeQueue::DoState serializes the entire fixed backing store. For
the sceAudio channel queues that is 512KB per channel (32768*8 s16
samples), or ~4.6MB of mostly dead bytes in every savestate across the
nine channels - the live sample count at any moment is normally a few
KB. This addresses the existing TODO in DoState.
Add DoStateCompact(), which stores only the live [head, head+count)
region and restores it linearized at the front of storage. A wrapped
live region is written as its two pieces in pop order; since the POD
DoArray path writes raw bytes with no per-element or per-call header,
the single linear read on load consumes them identically. The count is
validated on load and a bad value fails the load cleanly via
p.SetError.
AudioChannel bumps its section to v3 to use the compact form; old
states still load through the unchanged full-storage path. This shrinks
every savestate by several MB uncompressed and cuts the copy/compress
cost of each save, including the rewind feature's periodic states.
Check the ZIM header, dimensions, mip count, allocation arithmetic,
and uncompressed payload size before allocating or copying image data.
This prevents crafted texture files from overflowing the image buffer.
* Improve a couple of on-screen buttons (menu, fastforward)
* Fix the new continue button, oops
* Add some missing translations
* Split a translation string to make portrait look better
* More GameScreen redesign
* Don't accidentally go into game-specific mode
* Fix layout issue with popupscreens, fix context menu positioning
* One more icon
See https://github.com/hrydgard/ppsspp/pull/20902#issuecomment-3429764588 for details.
WARNING: not at all tested in actual PPSSPP, only godbolt for relevant snippet. Verification that it works would be good.
Again, this should be slightly slower than the current version, which shouldn't matter. The goal is accuracy/consistency here.
This makes SSE2 version match the (correctly-rounded)
scalar reference (which the current version doesn't:
see https://godbolt.org/z/hK5938jda).
The new implementation uses the same idea as mentioned in
https://github.com/hrydgard/ppsspp/pull/20870#issuecomment-3413134437
It may be a bit slower than current implementation (which
simply truncates?), but correctness/consistency is
probably worth it.
The difference is slight (by 1 in RGB color channels),
but observable in synthetic examples (in particular the
current implementation darkens completely opaque parts,
including `0xFFFFFFFF` -> `0xFFFEFEFE`, and, more
strikingly,`0xFF010101` -> `0xFF000000`).
This doesn't touch NEON part at all (so "vibe-coded" comment
stays for now), but it shouldn't be too hard to port.
Henrik Rydgård