mirror of
https://github.com/hrydgard/ppsspp.git
synced 2026-09-04 03:35:19 +02:00
Henrik Rydgård
4cd611b71f
AnalyzeAtracTrack used max(fileSize, size) as the chunk-parse bound with fileSize taken from the file's RIFF header, so a crafted inflated RIFF size could push reads past the end of the buffer. Keep the real-library behavior of tolerating a too-low size, but clamp the parse bound to the actual mapped guest memory at the buffer. Also guard ParseWaveAT3's RIFF scan against a blockSize < 4 underflow that could make the offset negative and bypass the loop bounds check, and clamp readSize to the mapped region in Atrac2::SetData before parsing.