AnalyzeAtracTrack used max(fileSize, size) as the chunk-parse bound with
fileSize taken from the file's RIFF header, so a crafted inflated RIFF
size could push reads past the end of the buffer. Keep the real-library
behavior of tolerating a too-low size, but clamp the parse bound to the
actual mapped guest memory at the buffer.
Also guard ParseWaveAT3's RIFF scan against a blockSize < 4 underflow
that could make the offset negative and bypass the loop bounds check, and
clamp readSize to the mapped region in Atrac2::SetData before parsing.
Need to make sure a buffer size check happens before the buffer is
accessed - since the game calls sceAtracSetDataAndGetID with both buffer
and bufferSize as 0, and it expects to receive TOO_SMALL and not a
memory exception.
Thanks to @sum2012 for quick investigationh help.
Henrik Rydgård