Henrik RydgårdandClaude Sonnet 5 1eab737e4d Serialize: guard List/Deque/Map/Set against corrupted size fields ...

DoVector already rejects an attacker/corruption-controlled size that
would resize far beyond what's actually left in the savestate buffer.
DoList/DoDeque/DoMap/DoMultimap/DoSet never got the same treatment -
a corrupted count field (e.g. 0xFFFFFFFF) drove an immediate huge
resize (list/deque) or an unbounded loop of allocations (map/set)
before any per-element bounds checking kicked in. All five now check
the declared count against PointerWrap::Remaining() first.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01L4QAoxV2KY7ek4PcZw3WvY

2026-08-10 01:00:28 +02:00

..

SerializeDeque.h

Serialize: guard List/Deque/Map/Set against corrupted size fields

2026-08-10 01:00:28 +02:00

SerializeFuncs.h

Add bounds checking to savestate deserialization

2026-08-01 11:57:24 +02:00

SerializeList.h

Serialize: guard List/Deque/Map/Set against corrupted size fields

2026-08-10 01:00:28 +02:00

SerializeMap.h

Serialize: guard List/Deque/Map/Set against corrupted size fields

2026-08-10 01:00:28 +02:00

Serializer.cpp

Serializer: fix OOB read loading a std::string from a savestate

2026-08-10 01:00:28 +02:00

Serializer.h

Reject ATRAC files with oversized packets at parse time; honor Verify errors

2026-08-01 11:57:27 +02:00

SerializeSet.h

Serialize: guard List/Deque/Map/Set against corrupted size fields

2026-08-10 01:00:28 +02:00