Commit Graph
6 Commits
Author SHA1 Message Date
Henrik RydgårdandClaude Sonnet 5 1eab737e4d Serialize: guard List/Deque/Map/Set against corrupted size fields
DoVector already rejects an attacker/corruption-controlled size that
would resize far beyond what's actually left in the savestate buffer.
DoList/DoDeque/DoMap/DoMultimap/DoSet never got the same treatment -
a corrupted count field (e.g. 0xFFFFFFFF) drove an immediate huge
resize (list/deque) or an unbounded loop of allocations (map/set)
before any per-element bounds checking kicked in. All five now check
the declared count against PointerWrap::Remaining() first.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01L4QAoxV2KY7ek4PcZw3WvY
2026-08-10 01:00:28 +02:00
Herman Semenov 192650f551 [Core/HLE/GPU/D3D11/GLES] Using for based loop C++17 and replaced on structured binding map C++17 2024-09-18 11:10:10 +02:00
Herman Semenov 45429bcd85 [Common/Data/File/Input/Net/Serialize/System/UI] Using for based loop C++17 and replaced on structured binding map C++17 2024-09-17 17:42:08 +02:00
Herman Semenov 3c66f149d3 [Common/Core/Windows] Removed excess check pointer before delete or free() 2024-09-17 11:34:42 +02:00
Unknown W. Brackets e49668eea7 SaveState: Correct missing switch case warnings. 2022-12-04 07:57:30 -08:00
Unknown W. Brackets b8342fb8ec SaveState: Rename ChunkFile files to Serialize.
Makes more sense and less weird than ChunkFileDoMap, etc.
2020-08-10 08:04:05 +00:00