A review of their savestates found nothing wrong with a normal save and
load, but a broken or crafted state could crash or write out of bounds:
- Atrac2's context pointer was dereferenced and its SAS buffer index used
unchecked. Atrac v1's file size sized an allocation before it was known
to be in the file, and its first buffer could be larger than the file.
- MediaEngine's MPEG header size and read position index a fixed array,
and its ringbuffer size sizes buffers.
- AuCtx's PCM buffer must hold two frames, as the game side requires. And
AuDecode compared a decoded frame with the whole PCM buffer instead of
the half it fills, so a frame between the two zero-filled a negative
size.
- BufferQueue's fill level, VAG block positions (now ending the voice,
like the other bad VAG state), sceAudiocodec's context count, the SRC
mix frequency (divided by), and old sceMpeg states' ringbuffer address.
- SAS decoding with an atrac id that has no atrac crashed after warning.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
When writing a decoded frame to swizzled VRAM, the staging buffer was
allocated for the guest's frame width but only the decoded width was
filled, so the row padding (heap residue including host pointers) was
swizzled into guest memory. Swizzling also reads whole 8-row tiles, past
the end of the buffer when the height isn't a multiple of 8.
Zero the staging buffer and size it (and the guest range check) for whole
tiles, with checked arithmetic. Rows are capped to the frame width so
they can't overlap or run past the end. writeVideoImageWithRange() also
swizzled from, and freed, the advanced row pointer instead of the start.
Discovered and reported by redthing1 (https://github.com/redthing1) of
V12 Security.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This reverts to the old behavior before we started parsing mpeg headers,
that is, in 558b462 which is part of #8867.
LunaMoo has this under "HackFixVideo" in his build.
See #8991. This doesn't really "fix" that, but works around it.
* Rename LogType to Log
* Explicitly use the Log:: enum when logging. Allows for autocomplete when editing.
* Mac/ARM64 buildfix
* Do the same with the hle result log macros
* Rename the log names to mixed case while at it.
* iOS buildfix
* Qt buildfix attempt, ARM32 buildfix
