pmf_init reported stream dimensions without a cap, and PMFView::Draw
allocated width * height * 4 with 32-bit int arithmetic, so a crafted
ICON1.PMF could overflow the allocation to a small buffer while
sws_scale wrote the full frame.
- Reject videos with dimensions outside 1..720x480 in pmf_init (PMFs on
the PSP never exceed 720x480).
- Use size_t arithmetic for the frame buffer allocation.
pngLoadPtr allocated the decoded buffer directly from attacker-controlled
PNG IHDR dimensions with no upper bound, so browsing a crafted game icon
or savedata could trigger a multi-gigabyte allocation.
- Add maxWidth/maxHeight parameters to pngLoadPtr (default 8192x8192)
and reject images larger than the limits.
- Thread the limits through LoadTextureLevelsFromFileData,
CreateTextureFromFileData, and CreateTextureFromFile.
- Limit game icons to 256x128 in GameInfoCache and IconCache.
Same treatment as Common/Core/GPU: move the ppsspp_ui target definition
(kept that name rather than renaming to "UI", since it was deliberately
named that in a previous commit) into UI/CMakeLists.txt, pulled in via
add_subdirectory(UI). Source paths are now relative to UI/ instead of
prefixed with "UI/".
PPSSPPHeadless and PPSSPPUnitTest already didn't link ppsspp_ui (they
link Core/Common directly) - that's unchanged, just preserved. The main
per-platform binaries (${TargetBin}) and the Android JNI target keep
linking it as before.
add_compile_definitions(USE_DISCORD=1) has to stay in the root file
rather than move into UI/CMakeLists.txt: it only affects targets created
after the call, and add_subdirectory() snapshots the parent's directory
scope at the point it's invoked, so the definition needs to already be
set before add_subdirectory(UI) runs. Verified UI/DiscordIntegration.cpp
still pulls in Discord_Initialize etc as undefined symbols post-move.
Also removed two now-dead variable inits sitting right next to this
block: "nativeExtra" (never appended to or consumed anywhere anymore,
a leftover from before the old "native" target was removed) and a
duplicate early set(UISource) (the real one now lives inside
UI/CMakeLists.txt's own scope).
Verified with a clean ./b.sh --debug rebuild, a HEADLESS=ON UNITTEST=ON
build (confirmed ppsspp_ui/UI never gets built in that configuration),
and a LIBRETRO=ON build.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSNaZnHCjmryS3ziVN9gZU
Henrik Rydgård