mirror of
https://github.com/hrydgard/ppsspp.git
synced 2026-09-04 03:35:19 +02:00
Henrik Rydgård
6d43b6f531
SeekFile stored a signed s32 position into the unsigned size_t seekPos, so a negative position (e.g. from a truncating s32 cast of a large lseek offset) wrapped seekPos to near 2^64. ReadFile's clamp arithmetic then also wrapped, driving a memcpy from a wild pointer. - Clamp the computed seek position to 0 in SeekFile. - Clamp the read size against the remaining data in ReadFile, returning 0 when seekPos is at or past the end.