mirror of
https://github.com/hrydgard/ppsspp.git
synced 2026-08-31 09:45:24 +02:00
Henrik Rydgård
0049b19fbf
Vuln 17: ReplacedTexture::LoadLevelData let a KTX2/DDS file at a higher mip level resize the shared data_ vector to its own (attacker-controlled) mip count, so data_[mipLevel + i] indexed out of bounds and the KTX2 branch resized a different element than it wrote to. Disallow mixing image formats across mip levels, cap the container mip count, and resize the same element that is used as the transcode destination. Vuln 18: DecodeTextureLevel only validated the start address for non-DXT textures, so guest-controlled w/h/bufw could drive reads past mapped RAM. Validate the needed range like the DXT path does and clamp the height; ReadIndexedTex now takes the clamped w/h.