mirror of
https://github.com/hrydgard/ppsspp.git
synced 2026-09-04 03:35:19 +02:00
Henrik RydgårdandClaude Opus 5
7e79334c18
segmentVAddr is a 32-entry array, but LoadInto filled it from e_phnum, which is a u16 - so an ELF declaring 65535 program headers wrote 65535 u32s into it, straight through the rest of the ElfReader object. The only check standing in front of that verified the program headers fit in the file, which a ~2MB crafted PRX satisfies. Rejected up front now: LoadRelocations already ignores segment numbers at or past the array size, so a module with more than that couldn't be relocated correctly anyway. Real modules have a handful - PSP_Header::nsegments is a u8 and no more than 4 are ever used. Second one from the same loop: with no PT_LOAD segment at all, totalStart stayed 0xFFFFFFFF and totalEnd 0, so totalSize came out as 1 (0 - 0xFFFFFFFF) and the loader went on to allocate a 1-byte block at 0xFFFFFFFF. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GZq8ZtJmFY7bkX5FVkr3P9