Files
ppsspp/Core/HLE
Henrik RydgårdandClaude Opus 5.5 0a778a13ff HLE: Check more guest buffers by their full length, and an empty insert
Calls that checked one byte of a game's buffer and then wrote or read the
whole thing, or trusted a negative length:
- sceNetEtherNtostr/Strton, the apctl BSS descriptor calls, GetState and
  sceNetGetDropRate.
- sceNpAuthGetTicket wrote its whole ticket whatever the length; it's
  now built locally and written once the buffer is known to hold it.
  sceNpAuthGetTicketParam checked its limits after copying, and walked
  ticket params past the ticket's end.
- sceNp2's communication ID and passphrase, a negative maxServerIds, and
  an unchecked unknown1Ptr.
- sceParseUri's work area and scheme string, sceParseHttp's negative
  header length and value address, and ReadVariableSizedStruct's size.
- sceKernelCreateLwMutex initialized the work area without checking it
  at all, and the other LwMutex calls checked one byte of it.
- sceNetAdhocctlGetScanInfo cleared the length the game gave, of a
  buffer checked by one byte (or any length, negative ones included).

Also: a game mode join inserted at begin() + 1 into a possibly empty
list of players.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-31 11:26:03 +01:00
..
2025-07-20 19:30:35 +02:00
…
…
…
…
2023-12-09 18:08:19 +01:00
2025-07-20 19:32:05 +02:00
2025-02-14 09:50:55 -06:00
2026-10-26 12:10:10 +01:00
…
2026-08-11 10:28:47 +02:00
2025-04-03 14:13:50 +02:00
2026-08-11 20:14:01 +02:00
…
…