mirror of
https://github.com/hrydgard/ppsspp.git
synced 2026-09-07 21:23:29 +02:00
Henrik Rydgård
c329363a7d
rc_bittree()/rc_number() can index bm_dist_bits up to column 50 and bm_dist up to row 43 (when decoding a "long distance" match, i.e. match_len > 2), but the arrays were only sized for 39 and 18 respectively. A crafted LZRC-compressed block (reachable via NPDRMDemoBlockDevice::ReadBlock) could drive these indices out of range, corrupting adjacent probability tables within the same LZRC_DECODE struct via rc_bit()'s read-modify-write. Size the arrays for the indices the algorithm can actually produce, and initialize them via sizeof() so the memset in rc_init stays correct.