mirror of
https://github.com/hrydgard/ppsspp.git
synced 2026-09-04 03:35:19 +02:00
Henrik RydgårdandClaude Sonnet 5
6ee6641fe5
ReadFile()/ReadSingleFileFromZip() allocated/resized directly off a zip entry's declared uncompressed size with no sanity check. A crafted size near UINT64_MAX would wrap ReadFile()'s "size + 1" to 0, allocating almost nothing while zip_fread() still writes the full declared size into it - a length-field-driven heap overflow from a malicious zip/texture pack. Both now reject entries above a generous 4GB cap. Also fixes GetFileInfo() reading zstat.name[strlen(name)-1] unchecked, which underflows to SIZE_MAX for a zero-length entry name. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01L4QAoxV2KY7ek4PcZw3WvY