mirror of
https://github.com/hrydgard/ppsspp.git
synced 2026-08-31 09:45:24 +02:00
Henrik Rydgård
6fb48fd45a
A crafted .cso compressed ISO could trigger a heap buffer overflow on any sector read, reachable via ordinary gameplay. Two root causes: 1. Unvalidated frame index deltas. ReadBlock/ReadBlocks computed a compressed read range from two adjacent frame-index-table entries. With non-monotonic entries, compressedReadEnd - compressedReadPos underflows as u64, producing a huge read size that fileLoader->ReadAt() wrote into the fixed-size readBuffer. 2. hdr.align (indexShift, 0-255) used as '1 << indexShift' was undefined behavior at >= 32, and frameSize + (1 << indexShift) could wrap, undersizing the buffer while inflate() was configured with the full frameSize. Fixes: - Validate the index table is monotonically non-decreasing in the constructor. - Reject files with indexShift > 20. - Use unsigned shift for buffer size math and store readBufferSize. - Clamp compressed read sizes to readBufferSize in both ReadBlock and ReadBlocks.