mirror of
https://github.com/hrydgard/ppsspp.git
synced 2026-08-31 09:45:24 +02:00
Henrik Rydgård
f15f8453f0
Ioctl's ISO9660 path table read re-read sector `block` (the first sector, already consumed by the preceding ReadBlocks) for the trailing partial sector instead of `block + blocks`, returning duplicated data from the start of the table instead of its actual tail. ReadDirectory() advanced by the raw on-disk dir.size without checking it's at least as large as the record's own header+identifier. A crafted directory sector could set dir.size = 1 repeatedly, making the loop reinterpret the same overlapping bytes as many separate entries - allocating far more TreeEntry objects than the sector's actual size should allow.