mirror of
https://github.com/hrydgard/ppsspp.git
synced 2026-10-15 15:30:29 +02:00
Henrik RydgårdandClaude Opus 5.5
70d64311af
When writing a decoded frame to swizzled VRAM, the staging buffer was allocated for the guest's frame width but only the decoded width was filled, so the row padding (heap residue including host pointers) was swizzled into guest memory. Swizzling also reads whole 8-row tiles, past the end of the buffer when the height isn't a multiple of 8. Zero the staging buffer and size it (and the guest range check) for whole tiles, with checked arithmetic. Rows are capped to the frame width so they can't overlap or run past the end. writeVideoImageWithRange() also swizzled from, and freed, the advanced row pointer instead of the start. Discovered and reported by redthing1 (https://github.com/redthing1) of V12 Security. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>