mirror of
https://github.com/hrydgard/ppsspp.git
synced 2026-08-31 17:55:23 +02:00
Henrik Rydgård
b7b96c3374
The LZRC decompressor's only bounds check for output (and input) was a debug-only _dbg_assert_msg_, which is a no-op in release builds. The NPDRM demo block device also passed a hardcoded 1 MiB output length while the real destination buffer (blockBuf_) could be as small as 2048 bytes, allowing a crafted NPDRM image to trigger an unbounded heap overflow during game load. Changes: - rc_putbyte/rc_getbyte now enforce real bounds and set an error flag instead of relying on debug asserts; decompression aborts with -1 on overflow or truncated input. - normalize() reads via rc_getbyte so it stays in bounds. - Plain-text path clamps the copy size to both the output buffer and the remaining input (and no longer interprets the size as signed). - NPDRMDemoBlockDevice::ReadBlock passes blockSize_ (the real buffer size) instead of 0x00100000 to lzrc_decompress. - Add unittest/TestLzrc (synthetic input, no test data files): checks the plain-text clamp, truncated input, and output overflow all fail safely. - AGENTS.md: note to reuse existing format handlers/decompressors before writing new ones.