mirror of
https://github.com/hrydgard/ppsspp.git
synced 2026-09-19 19:07:48 +02:00
Henrik RydgårdandClaude Opus 5
bb96802f72
KIRK CMD1 writes header + data_offset + align16(data_size) bytes into outbuf, and all three come out of the header the decrypter just decrypted, not from the caller. The SHA1 check doesn't bound them - it only covers the header, so it passes just as happily for a block that's been cut short. The PSAR walker has to guess how long an updater's second block is (nothing records it, so it tries the sizes real updaters use), and a wrong guess sent KIRK off the end of the buffer: unpacking a firmware crashed roughly half the time, on every version and disc I tried, depending on the heap layout. Bound the write against the size the caller gave us, in all six decrypt types. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>