Henrik Rydgård 779cae6232 Reject path traversal in savedata name fields ...

gameName/saveName/fileName and the saveNameList entries are
guest-controlled and get concatenated into host filesystem paths, so a
crafted request could escape the save directory with ../ sequences.

- PSPSaveDialog::Init rejects requests whose name fields contain a path
  separator ('/' or '\') or are bare dot components.
- SavedataParam::SetPspParam rejects saveNameList entries the same way.

2026-08-01 13:16:21 +02:00

..

Debugger

Add memory.search and hle.data.* to the WebSocket debugger

2026-07-26 21:17:09 +02:00

Dialog

Reject path traversal in savedata name fields

2026-08-01 13:16:21 +02:00

ELF

Fix out-of-bounds reads in PARAM.SFO parser

2026-07-31 20:54:17 +02:00

FileLoaders

Clamp HTTP response body to the requested range in HTTPFileLoader

2026-08-01 11:57:27 +02:00

FileSystems

Fix LZRC decompressor heap overflow and add unit test

2026-07-31 20:54:13 +02:00

Font

Bounds-check charPtr inside PGF::ReadCharGlyph

2026-08-01 11:57:27 +02:00

HLE

Fix out-of-bounds reads in ATRAC track parsing

2026-08-01 11:57:27 +02:00

HW

Buildfixes, dependency shuffling to make things more logical

2026-07-24 14:43:34 +02:00

MIPS

Same as GermanAizek's #21912, but using an existing function.

2026-07-13 11:25:37 +02:00

Util

Fix out-of-bounds reads in ATRAC track parsing

2026-08-01 11:57:27 +02:00

AVIDump.cpp

Remove the GPUDebugInterface class

2026-06-02 11:15:08 +02:00

AVIDump.h

rcheevos: Call rc_client_do_frame in the flip callback.

2025-05-25 22:21:37 +02:00

CMakeLists.txt

Fix build when USE_SYSTEM_MINIUPNPC cmake option is enabled. Adding a compile definition for it in Core/CMakeLists.txt is not enough; rather than add a duplicate definition in UI/CMakeLists.txt so NativeApp.cpp's include of Core/Util/PortManager.h handles the conditional location of miniupnpc headers correctly, adding it once in the root CMakeLists.txt ensures both Core and UI handle it properly

2026-07-26 13:10:50 -07:00

CmdLine.cpp

Add --print-equal-lines option to headless, good for context when looking at output

2026-07-29 18:55:00 +02:00

CmdLine.h

Add --print-equal-lines option to headless, good for context when looking at output

2026-07-29 18:55:00 +02:00

Compatibility.cpp

Return of "Disable range culling" but now only as a compat.ini setting to enhance games

2026-06-27 13:02:47 +02:00

Compatibility.h

Return of "Disable range culling" but now only as a compat.ini setting to enhance games

2026-06-27 13:02:47 +02:00

Config.cpp

Add new log category for config

2026-07-30 10:03:15 +02:00

Config.h

Claude's crazy exception handler hack

2026-07-27 23:41:13 +02:00

ConfigSettings.cpp

Core/UI: use clear() and empty() for std containers

2026-05-17 21:28:31 +03:00

ConfigSettings.h

Replace "ForceFullScreen" with a way to prevent specific settings from being saved.

2026-02-02 09:25:49 +01:00

ConfigValues.h

Add command line parameters for controlling the behavior on memory/instruction exceptions

2026-07-27 18:37:26 +02:00

ControlMapper.cpp

Don't have pauseTrigger as an output parameter from ControlMapper::Key()

2026-06-16 10:57:52 +02:00

ControlMapper.h

Don't have pauseTrigger as an output parameter from ControlMapper::Key()

2026-06-16 10:57:52 +02:00

Core.cpp

Use the new kernel module description thing to annotate GPRs in the register viewer

2026-07-28 00:15:41 +02:00

Core.h

Add command line parameters for controlling the behavior on memory/instruction exceptions

2026-07-27 18:37:26 +02:00

Core.vcxproj

Move Common/GraphicsContext.h to Common/GPU/GraphicsContext.h

2026-07-26 13:58:17 +02:00

Core.vcxproj.filters

Move Common/GraphicsContext.h to Common/GPU/GraphicsContext.h

2026-07-26 13:58:17 +02:00

CoreParameter.h

Headless improvements

2026-07-29 16:27:33 +02:00

CoreTiming.cpp

Build and warning fixes

2026-06-12 17:28:52 +02:00

CoreTiming.h

Clean up logging in scePowerSetClockFrequency

2026-06-12 12:23:36 +02:00

CwCheat.cpp

Also support the "Post-comment" syntax used by cheats.db for comments

2026-04-24 14:41:47 +02:00

CwCheat.h

Also support the "Post-comment" syntax used by cheats.db for comments

2026-04-24 14:41:47 +02:00

EmuThread.cpp

Move Common/GraphicsContext.h to Common/GPU/GraphicsContext.h

2026-07-26 13:58:17 +02:00

EmuThread.h

Use the new common RunMainLoop on Android

2026-07-26 13:42:16 +02:00

FFMPEGCompat.h

…

FrameTiming.cpp

Add sanity check to frame timing

2026-02-19 00:35:33 +01:00

FrameTiming.h

Rework the present mode settings, refactor.

2025-10-20 21:28:38 +02:00

HDRemaster.cpp

…

HDRemaster.h

…

Instance.cpp

…

Instance.h

…

KeyMap.cpp

Search: Skip spaces and control characters, code cleanup, fix minor issue on desktop

2026-05-11 11:45:04 +02:00

KeyMap.h

Add a "hold" version of the axis swap toggle. Often more convenient.

2026-03-05 23:05:35 +01:00

KeyMapDefaults.cpp

Add some bindings for the right analog stick by default (for right-stick patches)

2026-06-03 18:49:10 +02:00

KeyMapDefaults.h

Remove pretense of supporting the Ouya (we don't anymore)

2025-02-24 15:57:38 -06:00

Loaders.cpp

Unbreak loading homebrew. Followup to #21894, oops

2026-07-08 19:32:37 +02:00

Loaders.h

Improve error checking on game launch.

2026-07-08 12:04:15 +02:00

LuaContext.cpp

LuaContext.cpp: fix GCC warning

2025-05-31 18:25:55 +02:00

LuaContext.h

More work on the lua console

2025-03-27 14:26:48 +01:00

MemFault.cpp

Use the new kernel module description thing to annotate GPRs in the register viewer

2026-07-28 00:15:41 +02:00

MemFault.h

…

MemMap.cpp

Brave Story: Hack to make the bloom effect run much more efficiently.

2026-01-23 23:13:04 +01:00

MemMap.h

Fix behavior so we can turn off "IgnoreBadMemAccess" in headless

2026-07-29 18:38:25 +02:00

MemMapFunctions.cpp

Fix a bunch of possible crashes due to our VRAM check thinking that VRAM in kernel space is valid (but nothing is mapped there, unless you use masked memory)

2026-07-27 23:44:14 +02:00

MemMapHelpers.h

…

Opcode.h

…

PSPLoaders.cpp

Skip savestate migration if game ID strings contain a path separator

2026-08-01 11:41:24 +02:00

PSPLoaders.h

Headless improvements

2026-07-29 16:27:33 +02:00

Replay.cpp

Remove redundant .c_str()

2025-08-31 13:37:43 +02:00

Replay.h

…

Reporting.cpp

VertexDecoder: Refactor away lowerbound/upperbound parameters

2026-02-05 13:26:17 +01:00

Reporting.h

…

RetroAchievements.cpp

Fix unnecessary RAIntegration error message if you have the DLL but RA is disabled

2026-07-28 00:16:12 +02:00

RetroAchievements.h

RAIntegration crashfix

2026-07-27 18:37:28 +02:00

SaveState.cpp

Add bounds checking to savestate deserialization

2026-08-01 11:57:24 +02:00

SaveState.h

Code cleanup for save state notification, add metadata field

2026-05-19 11:07:07 +02:00

SaveStateRewind.cpp

SaveState: Show time/date when loading states

2026-05-19 12:19:40 +02:00

SaveStateRewind.h

Show timestamps when loading rewind states

2026-05-19 11:58:01 +02:00

Screenshot.cpp

Remove the concept of scaled/offset depth buffers.

2026-06-10 10:41:30 +02:00

Screenshot.h

Rework the internal screenshot API, fix bug causing screenshotting to get stuck

2026-02-13 12:34:26 +01:00

System.cpp

Headless improvements

2026-07-29 16:27:33 +02:00

System.h

Add a workaround for boot-up crashes caused by switching away from the app while waiting for the boot-up thread to finish

2026-02-24 00:56:45 +01:00

TiltEventProcessor.cpp

Fix the toggle touch controls input (properly this time)

2026-02-05 09:44:42 +01:00

TiltEventProcessor.h

…

WaveFile.cpp

…

WaveFile.h

…

WebServer.cpp

Fix upload filename traversal

2026-07-23 15:04:04 -04:00

WebServer.h

More upload UI polish

2025-10-27 12:20:24 +01:00

x360_compat.h

…