mirror of
https://github.com/hrydgard/ppsspp.git
synced 2026-09-07 13:13:24 +02:00
Henrik Rydgård
6929a0d9ae
gpu.buffer.*'s "uri" output type let a client supply an arbitrary stackWidth with no upper bound, used as the starting divisor in a loop that decrements until it evenly divides the buffer's actual (small) pixel count - a client sending a huge stackWidth (up to ~2 billion) stalls the connection's handler thread for that many iterations. Clamp it to the actual pixel count first. gpu.buffer.texture's level parameter was forwarded as-is (u32) into GPU_GetCurrentTexture(), which takes a plain int - a client-supplied value whose u32->int conversion is negative skips backends' "level >= mip count" bounds check (which only fires for level > 0), reaching backend texture-copy code with a bogus mip index. Reject it upfront.