mirror of
https://github.com/hrydgard/ppsspp.git
synced 2026-09-03 11:15:20 +02:00
Henrik Rydgård
029066a977
- DisassemblyFunction/DisassemblyData::getLineAddress() indexed lineAddresses[0] unconditionally; a zero-size symbol (reachable via the WebSocket debugger's hle.func.add/hle.data.add with an attacker-controlled size, a crafted ELF symtab entry with st_size==0, or the debugger UI's "set function size") leaves that vector empty, making findDisassemblyEntry's getLineAddress(0) call undefined behavior. Fall back to the symbol's own base address when out of range instead. - DisassemblyData::createLines() detected an invalid address range and logged it, but fell through anyway into a loop reading through that whole range with the Unchecked memory accessors, which on non-masked builds do a raw pointer dereference with no bounds check at all. Added the missing return. - DisassemblyLineInfo::ToString()'s snprintf calls all used sizeof(text) where text is a char* parameter (pointer size, not buffer size), silently truncating all output to a few characters instead of using the real bufSize parameter that was passed in but never used. - analyze()'s misaligned-tail-data case stored the DisassemblyData entry under key alignedNext, but constructed it with the earlier (possibly much earlier) `address` as its own base address instead of alignedNext, misattributing those bytes to the wrong location.