mirror of
https://github.com/hrydgard/ppsspp.git
synced 2026-08-31 09:45:24 +02:00
Henrik Rydgård
a82043eb9d
numFrames and numBlocks are derived from the same attacker-controlled 64-bit total_bytes field, but independently truncated to 32 bits using different divisors (frameSize vs. the fixed 2048-byte block size). With extreme total_bytes/block_size combinations the two truncations can disagree so that numBlocks (which gates ReadBlock's bounds check) describes more blocks than numFrames actually covers - ReadBlock then indexes the numFrames+1-sized `index` array one or more elements past its end. Reject any header where this could happen before allocating anything.