mirror of
https://github.com/hrydgard/ppsspp.git
synced 2026-09-07 21:23:29 +02:00
Henrik Rydgård
2994145f86
ReadFile and the read-path-table ioctl both read a sector into a stack buffer and memcpy it to the destination without checking whether the read succeeded. FileBlockDevice::ReadBlock returns false on a short read and leaves the buffer untouched, so a read past the end of a truncated or crafted image copies 2KB of uninitialized host stack into guest-visible memory. Zero the buffer on failure, and bail out of the ioctl if the volume descriptor can't be read instead of using a garbage path table length. The constructor already checked that same read. ReadBlocks writes straight into the caller's buffer, so a partial read there leaves stale data rather than host memory - left alone deliberately, since zeroing it would throw away the valid prefix on a truncated image.